Communication templates to use in an incident

---

You can use these email templates to keep staff, parents and carers, students, and the media informed throughout a cyber incident. This isn’t an exhaustive list; there may be others you need to communicate with.

School remaining open

Email to parents and carers

Dear parent/carer, It appears [name of school] has been affected by [a cyber attack/serious system outage]. This has affected [some/all] of our IT systems. This means that we currently cannot access: [list what is impacted, such as telephones, emails, servers, MIS] We do not currently know how long it will take to restore our systems OR We expect systems will be restored by [anticipated date of restoration] OR We will work with the [trust / local authority], IT providers and other third parties [Department for Education / NCSC / local police constabulary] to restore functionality and normal working as soon as possible. We are in contact with our Data Protection Officer. If required, we will report this data breach to the Information Commissioners Office (ICO) in line with requirements of the Data Protection Act 2018 / GDPR. We are taking every action to minimise disruption and data loss. In consultation with the [trust / local authority] we have completed a risk assessment on all areas affected to address concerns about the safeguarding of our learners and staff. The school will remain open with the following changes: [detail any changes required] [IF APPLICABLE] I appreciate that this will cause some problems for parents and carers and apologise for any inconvenience. We will continue to assess the situation and update you. [If possible, inform how you will update, such as via website or text message] Yours sincerely,

Email to school staff

[School name] detected a cyber attack on [date] which has affected the following IT systems: [provide a description of the services affected] Following discussion with the [trust / local authority] the school will remain open with the following changes to working practice: [detail any workarounds and/or changes] We are in contact with our Data Protection Officer and will report to the ICO, if necessary, in line with statutory requirements of the Data Protection Act 2018 and GDPR. This incident is being investigated by the relevant authorities. If they ask you for any information as part of the on-going investigation, please provide it promptly. We have taken immediate action to mitigate data loss, limit severity, and restore systems. You are reminded you must not make any comment or statement to the press, legal guardians or wider community about this incident or its effects. Queries should be directed to [insert staff name].

School is closing

Email to parents and carers

Dear parent/carer, I am writing to inform you that it appears [school name] has been affected by [a cyberattack/serious system outage]. This has taken down the educational setting IT system. This means that we currently do not have any access to [list what is impacted, such as telephones, emails, servers, MIS]. We currently do not know how long it will take to restore our systems. We are in contact with our Data Protection Officer. We have reported this data breach to the Information Commissioners Office (ICO) in line with requirements of the Data Protection Act 2018 / GDPR. In consultation with the [trust/local authority] we have completed a risk assessment on all areas affected to address concerns surrounding the safeguarding of our learners and staff. We have no option other than to close the educational setting to learners on [closure date]. We are currently planning that the educational setting will be open as normal on [estimated opening date]. I appreciate that this will cause some problems for you around childcare arrangements. We apologise for the inconvenience but feel that we have no option. We will work with the [trust/local Authority], IT providers and other relevant third parties [Department for Education / NCSC / local police constabulary] to restore functionality and re-open as soon as possible. We will continue to assess the situation and update you. [If possible, inform how you will update, such as via website or text message]. Yours sincerely,

Email to school staff

The school detected a cyber-attack on [date] which has affected the following educational setting IT systems: [provide a description of the services affected] Following liaison with the [trust/local authority] the educational setting will close to learners [on date OR with immediate effect]. [Detail any workarounds, changes or remote learning provisions] The educational setting is in contact with our Data Protection Officer, and we have reported the incident to the ICO, in line with the statutory requirements of the Data Protection Act 2018 / GDPR. This incident is being investigated by the relevant authorities. If you are asked for any information as part of the on-going investigation, please provide it promptly. The educational setting has taken immediate action to mitigate data loss; however, we are unsure when systems will be restored. Staff will be kept informed via [telephone/ email/staff noticeboard]. All staff are reminded that they must not make any comment or statement to the press, legal guardians, or wider community with regards to this incident or its effects. Queries should be directed to [insert staff name].

Media statement

Media statement

[Insert school name] detected a cyber-attack on [date] which has affected the school’s IT systems. Following liaison with the [trust/local authority] the school [will remain open/is currently closed] to learners. The school is in contact with their Data Protection Officer and will report to the ICO, if necessary, in line with statutory requirements of the Data Protection Act 2018 / GDPR. This incident is being investigated by the relevant authorities, and the school has taken immediate remedial action to limit data loss and restore systems.

Standard response

A standard staff response for serious IT incidents should reflect only information which is already freely available and has been provided by the educational setting in initial media responses.

To school staff

• the information provided should be factual and include the time and date of the incident
• staff should not speculate how long systems will take to be restored but can provide an estimate if this has been agreed
• if no restoration date has been advised, staff should merely state that work is on-going and that services will resume as soon as possible
• staff should direct further enquiries to an assigned contact/educational setting website/other pre-determined communication route

To learners

• For staff responding to pupil requests for information, responses should reassure concerned learners that incidents are well prepared for, alternative arrangements are in place and that systems will be back online shortly.
• Staff should address any outlandish or suggested versions of events by reiterating the facts and advising learners that this has been confirmed in letters / emails to legal guardians / carers.
• Staff should not speculate or provide learners with any timescales for recovery unless the sharing of timescales has been authorised by senior staff.

---

Page last reviewed
30 March 2026