Keeping your nursery safe from cyber threats 

 

In today’s early years settings, safeguarding is no longer just about physical safety. Increasingly, it also means protecting the digital information we hold about children, families and staff. From online registers and learning journals to payroll systems and email communication, nurseries now rely heavily on digital tools. While these bring enormous benefits, they also create new risks. Cyber threats no longer only affect large corporations; they are very real for small settings, too. 

So, what do nursery leaders, managers and practitioners need to know, and how can you protect your setting? 

 

What are cyber threats? 

 

A cyber threat is any attempt to access, damage or steal digital information. In a nursery context, this usually involves: 

• Phishing emails – messages designed to trick staff into clicking links or sharing passwords  

• Ransomware – systems are locked, and payments are demanded  

• Data breaches – sensitive information is accessed, lost or shared inappropriately  

• Unauthorised access – someone logging into systems without permission  

Phishing remains the most common entry point, often impersonating trusted contacts such as local authorities, suppliers or even parents.  

 

Why nurseries are a target 

It is easy to assume that small settings are unlikely to be targeted or adopt an ‘it’ll never happen here’ attitude. In reality, cyber criminals often look for smaller organisations that may have fewer protections in place. 

Nurseries hold highly sensitive information, including: 

• Children’s personal details and safeguarding records  

• Parent/carer contact and payment information  

• Staff records and payroll data  

Cyber attacks and data breaches are now a significant safeguarding concern for early years settings. According to a sector survey, around one in four nurseries have experienced a breach. The childcare and education sector accounts for over 14% of all reported UK data breaches, and more than 560 breaches in 2023 involved children’s data, highlighting the vulnerability of the sector and the need for stronger cybersecurity practices. A breach can have serious consequences – not just financially, but emotionally and reputationally.  

 The Kido nursery chain attack is a stark example of what can happen: 

• Hackers reportedly leaked 8,000+ records of children and staff.

• Some photos, addresses, and personal data were posted online 

• Parents were threatened with extortion 

Although Kido notified affected families and regulators, this represented a serious breach.  

 

What UK law says  

All nurseries/pre-schools, early years settings and childminders in the UK must comply with the UK GDPR and the Data Protection Act 2018. 

This means that as an organisation/childminder, you must: 

• Collect and use data lawfully and transparently  

• Keep that information secure and accurate  

• Only store what is necessary  

• Ensure appropriate safeguards are in place  

Children’s data is given extra protection under UK GDPR, meaning settings must take particular care when handling it. It is often useful to appoint someone to be responsible for data protection, and who will act swiftly and according to the law in the event of a breach.  

 

What if there is a cyber breach? 

If an incident leads to a personal data breach (whether digital or otherwise), you must: 

• Report it to the Information Commissioner’s Office (ICO) within 72 hours (if there is a risk to individuals).  

• Inform affected individuals if the risk is high, which is usually the case because children’s data is classed as sensitive 

• Take steps to contain and investigate the breach  

Having a clear response plan in place is essential. There are no major differences in the core legal framework across England, Scotland, Wales and Northern Ireland, as UK GDPR applies nationwide. However, local safeguarding procedures and reporting structures may vary slightly. 

 

Common causes of cyber incidents 

Interestingly, most cyber incidents are not caused by sophisticated hacking or criminal gangs. The biggest risks are often everyday mistakes which can be avoided or the risks reduced with better safeguards.  

Common causes include: 

• Weak or shared passwords  

• Clicking unsafe links  

• Lost or stolen devices  

• Sending information to the wrong person  

• Lack of staff training  

Human error is widely recognised as the leading cause of data breaches in education settings.  

 

Practical ways to protect your nursery 

The good news is that many effective actions are simple, low-cost, and highly impactful. These should be your starting point and include: 

 

1. Staff awareness and training

Make sure all staff understand:

• How to spot phishing emails  

• The importance of strong passwords  

• What to do if something goes wrong  

Even short, regular reminders through notices or in staff meetings can make a big difference. 

 

2. Strong password policies

• Use long, unique passwords (using three random words works well)  

• Avoid sharing logins  

• Change passwords immediately if a breach is suspected  

 

3. Regular updates

Ensure all devices and software are updated regularly. Updates often include essential security fixes.

 

4. Access control

Only give staff access to the information they need for their role. Remove access promptly when staff leaveor change jobs. 

 

5. Data minimisation

Only keep the data youreally need. The less you store, the less there is to lose. 

 

6. Backups

Regularly back up your data securely. This is your safety netin the event of ransomware. 

 

In addition to the steps above, there are protections you can add that may involve some cost but will strengthen your protection further. These include: 

 

1. Secure nursery management systems

Use reputable, GDPR-compliant software, rather than relying on unsecured spreadsheets or poorly managed paper systems. 

 

2. Antivirus and security software

Basic protection is essential for all devices.Additional security tools may be appropriate depending on the size and needs of your setting. 

 

3. Multi-factor authentication (MFA)

This adds an extra layer of security, requiring a second form of verificationsuch as a code sent to a mobile phone or generated by an authenticator app. 

 

4. IT support or managed services

For larger settings, professionalIT and infrastructure support can help ensure compliance and ongoing protection. 

 

Embedding cyber security into safeguarding culture 

Cyber security should not sit separately from other safeguarding responsibilities. It is part of protecting children and families. Including cyber security in safeguarding policies and discussing it in staff meetings is best practice, and completing regular audits of your systems is vital. Help is available from the National Cyber Security Centre (NCSC), which provides tailored advice for early years settings. 

 

By taking small, practical steps, you are not just protecting your systems – you are protecting the trust that families place in you every day. 

 

References and further reading 

• Information Commissioner’s Office (ICO) – Data protection guidance for early years  
• National Cyber Security Centre (NCSC) – Early years cyber security guidance  
• UK GDPR and Data Protection Act 2018  
• Cyber-security-and-the-UK-early-years-sector-Report-February-2023_compressed.pdf 
• NMT Magazine – Childcare and education sector data breaches article 
• How to be GDPR compliant (Parenta guide) 
• BBC News Nursery cyber attack report 
• Childcare providers given guidance by GCHQ to help stop cyber attacks