--- title: "Great Marlow School partially closed after cybe… | Firevault" description: "A malware incident has shut down ICT systems at Great Marlow School in Buckinghamshire, cancelling lessons and silencing parent communications. Here is what…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure#webpage", "url": "https://fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure", "name": "Great Marlow School partially closed after cybe…", "description": "A malware incident has shut down ICT systems at Great Marlow School in Buckinghamshire, cancelling lessons and silencing parent communications. Here is what…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/great-marlow-school-cyber-hero.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Great Marlow School partially closed after cyber attack", "item": "https://fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Great Marlow School partially closed after cyber attack", "description": "A malware incident has shut down ICT systems at Great Marlow School in Buckinghamshire, cancelling lessons and silencing parent communications. Here is what it tells us.", "url": "https://fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/great-marlow-school-cyber-hero.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/great-marlow-school-cyber-hero.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/great-marlow-school-cyber-hero.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/great-marlow-school-cyber-hero.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-06-14T15:18:42.938666+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/great-marlow-school-cyber-attack-partial-closure" }, "inLanguage": "en-GB", "articleSection": "News", "wordCount": 657, "keywords": "Great, News, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "A secondary school in Buckinghamshire has been forced to partially close after a cyber attack disrupted its IT systems and communications. Great Marlow School confirmed that a malware incident had affected its ICT network, prompting staff to shut down parts of the system as a precaution while an investigation continues. What happened According to the school and reporting by the BBC, the disruption", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview What happenedWhy a school is a targetThe pattern we keep seeing in UK…What schools should do differentlyThe Firevault viewMore Resources [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · 14 June 2026 # Great Marlow School partially closed after cyber attack A malware incident has shut down ICT systems at Great Marlow School in Buckinghamshire, cancelling lessons and silencing parent communications. Here is what it tells us. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 4 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fgreat-marlow-school-cyber-attack-partial-closure)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fgreat-marlow-school-cyber-attack-partial-closure&text=Great%20Marlow%20School%20partially%20closed%20after%20cyber%20attack%0A%0AA%20malware%20incident%20has%20shut%20down%20ICT%20systems%20at%20Great%20Marlow%20School%20in%20Buckinghamshire%2C%20cancelling%20lessons%20and%20silencing%20parent%20communications.%20Here%20is%20what%20it%20tells%20us.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fgreat-marlow-school-cyber-attack-partial-closure)[](mailto:?subject=Great%20Marlow%20School%20partially%20closed%20after%20cyber%20attack&body=A%20malware%20incident%20has%20shut%20down%20ICT%20systems%20at%20Great%20Marlow%20School%20in%20Buckinghamshire%2C%20cancelling%20lessons%20and%20silencing%20parent%20communications.%20Here%20is%20what%20it%20tells%20us.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fgreat-marlow-school-cyber-attack-partial-closure) ![Great Marlow School exterior showing an open area with picnic benches beneath a glass and metal curved canopy.](/news/great-marlow-school-cyber-hero.jpg) Great Marlow School exterior showing an open area with picnic benches beneath a glass and metal curved canopy. Why it matters ## What this means for organisations holding critical data A malware incident has shut down ICT systems at Great Marlow School in Buckinghamshire, cancelling lessons and silencing parent communications. Here is what it tells us. In this analysis 1. 01 [What happened](#section-0) 2. 02 [Why a school is a target](#section-1) 3. 03 [The pattern we keep seeing in UK…](#section-2) 4. 04 [What schools should do differently](#section-3) **On this page**[What happened](#section-0)[Why a school is a target](#section-1)[The pattern we keep seeing in UK…](#section-2)[What schools should do differently](#section-3) A secondary school in Buckinghamshire has been forced to partially close after a cyber attack disrupted its IT systems and communications. Great Marlow School confirmed that a malware incident had affected its ICT network, prompting staff to shut down parts of the system as a precaution while an investigation continues. ## What happened According to the school and reporting by the BBC, the disruption has left Great Marlow School unable to contact parents and carers through its usual email system, and unable for teachers to set work in the normal way. Students in Years 11 and 13 were told to attend for external exams, but the school was closed to most pupils on Wednesday and internal exams for Years 10 and 12 were postponed. A Year 7 rowing lesson was also cancelled. Headteacher Guy Pendlebury said the school was working with cyber-security professionals to restore normal operations and was responding in line with guidance from the Department for Education and the National Cyber Security Centre. ## Why a school is a target Schools sit on a perfect storm of conditions for attackers. They hold sensitive data on minors, staff and finances. They run lean IT teams. They depend on a small number of cloud platforms for everything from registers to safeguarding logs. And they are obliged to keep operating, which makes recovery pressure unusually high. Most school networks are also flat by design. Once an attacker is inside the email system or the management information system, lateral movement to file shares, printers and curriculum systems is rarely difficult. ## The pattern we keep seeing in UK education Great Marlow joins a long and growing list of UK schools, colleges and academy trusts hit by ransomware or destructive malware in recent years. The National Cyber Security Centre has issued repeated warnings to the education sector, and the Information Commissioner has published guidance for schools recovering from incidents. The common thread is not exotic attacker tooling. It is the absence of a clean, offline, verifiable copy of the data that matters, combined with a network where one compromised account can reach almost everything. ## What schools should do differently - Hold at least one copy of critical data offline, in hardware the IT team can physically see and physically disconnect. - Segment the network so that the email tier, the curriculum tier and the safeguarding tier cannot freely reach each other. - Rehearse recovery on the assumption that the online backup is also compromised. If the recovery plan depends on the same cloud tenancy that was breached, it is not a recovery plan. - Keep a tested out-of-band channel for contacting parents when the main email system is down. ## The Firevault view Mark Fermor, co-founder of Firevault, said: "What happened at Great Marlow is not a failure of one school. It is a failure of an architecture that asks education to defend the same attack surface as a bank, with a fraction of the budget and none of the regulatory air cover. The answer is not more cloud. The answer is a copy of the data that the attacker cannot reach, because it is not on the network at all." Firevault [Offline Secure Storage](/offline-secure-storage) holds a copy of the data that matters in hardware that is physically disconnected from the internet by default. Firebreak adds a hardware boundary between the parts of a school network that need to talk to the outside world and the parts that do not. Together they remove the single point of failure that turns a malware incident into a multi-week closure. Read more about how this approach works in [Offline Secure Storage](/how-it-works/offline-secure-storage) and [Control](/control). **How Firevault helps** - **[Offline Secure Storage](/offline-secure-storage)** keeps gold-copy data physically disconnected from the network, so a ransomware or exfiltration event cannot reach it. - **[Control](/control)** gives boards and operators a single view of what is online, what is isolated, and what is recoverable across the estate. _Talk to Firevault about [Disconnect to Protect®](/about) for your organisation._ Sources ## Where this reporting comes from 01 **Original report**Primary coverage referenced in this analysis [View original article](https://www.bbc.co.uk/news/articles/c4gyvexy8z1o) About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. [Get started](/get-started)[Talk to the team](/demo) **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful [ ![Firevault Awarded Cyber Essentials and Cyber Essentials Plus Certification](/__l5e/assets-v1/446b675b-b48b-4b8e-ba01-b97ad3abf97d/firevault-cyber-essentials-plus-certified-2x.jpg) News ### Firevault Awarded Cyber Essentials and Cyber Essentials Plus Certification Firevault has been awarded Cyber Essentials and Cyber Essentials Plus certification, the UK Government-backed scheme run by the NCSC, following an independent technical audit of its systems and controls. 26 Jul 2026 2 min ](/news/firevault-cyber-essentials-plus-certified)[ ![Russian hackers steal UK government logins: why offline vaults change the equation](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Frussian-hackers-uk-government-logins.jpg) News ### Russian hackers steal UK government logins: why offline vaults change the equation The Telegraph reports that Russian-linked hackers have harvested UK government login credentials and traded them on dark-web forums. The incident is a reminder that credentials, however well protected in the cloud, remain the single point of failure that offline data vaults are designed to remove. 7 Jul 2026 4 min ](/news/russian-hackers-steal-uk-government-logins-offline-vaults)[ ![School Ransomware: Files Must Live Offline](/__l5e/assets-v1/5dcdf155-e287-48e8-bf9b-82b9837b80d0/school-ransomware-safeguarding-2x.jpg) News ### School Ransomware: Files Must Live Offline St Anne's Catholic School in Southampton was shut for four days after ransomware hit its network. It is not the first school to be targeted. From nurseries to councils, sensitive safeguarding data remains dangerously exposed on connected systems. 27 Mar 2026 7 min ](/news/st-annes-southampton-ransomware-safeguarding-files-physically-offline)[ ![TfL Hack: 10 Million Records Stolen](/__l5e/assets-v1/77ff397a-d530-4aee-88e3-5098513ae34e/tfl-hack-10-million-scattered-spider-2x.jpg) News ### TfL Hack: 10 Million Records Stolen Transport for London has confirmed that around 10 million customer records were stolen during the 2024 Scattered Spider cyber attack, making it one of the largest data breaches in British history. The revelation raises urgent questions about transparency, regulatory accountability and the case for offline secure storage. 11 Mar 2026 5 min ](/news/tfl-hack-10-million-records-stolen-scattered-spider)[ ![Firevault: 2025 Tech Trailblazers Shortlist](/__l5e/assets-v1/c2acabab-9ada-4969-9d69-b18478181083/firevault-shortlisted-trailblazers-v2-1771248067838-2x.jpg) News ### Firevault: 2025 Tech Trailblazers Shortlist We’re proud to announce that Firevault Limited has been shortlisted for the 2025 Tech Trailblazers Awards, recognised in the Firestarter category. For a young… 29 Nov 2025 6 min ](/news/firevault-shortlisted-for-the-2025-tech-trailblazers-firestarter-award)[ ![Sona Insurance Partners with Firevault](/__l5e/assets-v1/4590a187-a191-4f4d-a295-bab12f2594cc/sona-insurance-partnership-1771248017904-2x.jpg) News ### Sona Insurance Partners with Firevault We’re proud to announce that Sona Insurance Solutions , the Colchester-based independent insurance broker, has become the first broker in the UK to partner… 10 Nov 2025 3 min ](/news/sona-insurance-solutions-partnership) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)