NCFE shuts down systems following cybersecurity incident

NCFE, a major technical and vocational awarding organisation, has been forced to take its IT systems offline after detecting a "cyber security incident" that is causing widespread disruption to assessments and learner registrations across the UK.

NCFE said it identified "suspicious activity" on its network late last week and moved immediately to shut down access to all online systems as a precaution. The action has temporarily disabled staff email accounts, phone lines, live web chat and the organisation's critical 'Portal' platform used by centres to register learners, upload evidence and claim certificates.

T-Level assessments planned for this week will still go ahead, and centres can continue to book on-demand functional skills assessments. However, all paper-based exams, as well as face-to-face and remote apprenticeship end-point assessments scheduled from 1st December, have been suspended and will be rearranged.

Students are also currently unable to upload employer-set project evidence for T Levels. Any late registration or late booking fees that arise because of the downtime will be waived.

NCFE said it is working urgently to restore services but acknowledged the impact of the outage.

External cybersecurity specialists have been brought in and are in the early stages of a forensic investigation to establish what happened and whether any data was compromised.

NCFE said it is too early to confirm the extent of the incident or any potential breach of sensitive information.

"These investigations take time, but please be assured that understanding this is a key focus of our investigation," the organisation said in a statement.

Chief executive David Gallagher apologised for the incident, saying their staff is working "around the clock" to bring systems safely back online.

"I am sorry for any inconvenience or concern this incident may cause. Please rest assured that our team is working around the clock to return operations to normal."

Cybersecurity specialists say the nature of the shutdown suggests a potentially serious attack. Ryan McConechy, CTO at Barrier Networks, said: "This attack represents a major disruption, and is undoubtedly a huge blow to the organisation and the learners who rely on it. The December exam period is an important one, and typically very busy, as learners are tested on prior months of study."

McConechy described the education sector as a "key target" for cybercriminals due to limited resources and security infrastructure compared to large private and state-owned bodies.

He suggested ransomware could be involved: "It's unclear at this stage what precisely has affected the NCFE, but the awards body has been forced to shut down many of its online systems. It's not unlikely the NCFE is dealing with some form of ransomware. This could mean potential disruption for months, depending on the extent of the damage caused."

The qualifications regulator Ofqual confirmed it is aware of the incident and remains in close with NCFE. A report from Ofqual last year highlighted two cyberattacks affecting awarding organisations in 2024 – one targeting a body affiliated to three awarding organisations, and another hitting an organisation delivering general qualifications.