In October last year, the commissioner’s office received a data breach report from a primary school that had been the victim of a so-called crypto-ransomware attack, whereby parts of the school’s information systems had been encrypted by a third party.