This Is Sexual Extortion of Schools, and We Saw It Coming

By Kirra Pendergast

Somewhere in the United Kingdom, late last year, an email arrived at a school. Inside it were images of children who attend that school. Real children, named and recognisable, their faces lifted from the school’s own website and social media accounts, then run through an AI tool and turned into sexual abuse material. The message attached to them was simple. Pay, or we publish.

In my Professional Learning sessions I ask school leadership teams to sit with what that actually is, because the language we keep reaching for is too soft for it. This is not a privacy lapse. It is not an image policy that needs tidying up. It is extortion. More precisely, it is sexual extortion aimed at a school, and it borrows its entire structure from ransomware. A criminal takes something that matters to you, in this case the dignity and the safety of the children in your care, holds it hostage, and demands money to stop the harm. The only real difference between this and the ransomware attacks that have crippled hospitals, governments and businesses of all sizes is the nature of the hostage. It is not your data being held to ransom. It is your students.

The UK National Crime Agency, the Internet Watch Foundation, and the Early Warning Working Group, whose members include the NSPCC and Education Scotland, have now issued guidance telling schools to remove identifiable photographs of children from their websites and social media. The Internet Watch Foundation confirmed the case I have just described, and classified 150 of those images as child sexual abuse material under UK law. It created a digital fingerprint for each one and shared them with the major platforms to block reuploads. It also confirmed that this was not the only incident of its kind in the UK.

I take no comfort in any of this, because I have been describing this exact mechanism for years in countless media interviews, parliamentary inquiries and radio.

In 2022 I wrote about consent and how a child who cannot consent has their image placed online by the very adults who are meant to protect them, and how once something is online it does not truly come back (Consent of Children on Social Media).

In March 2025 I wrote about the irony of age restrictions on social media use in Australia media while schools themselves were still publishing those same children’s faces and names on school pages (The Ban Is Coming. And the Irony?).

In June 2025 I wrote, in plain terms, about how photographs on a school Facebook page had already become AI training data, and why a face-on named photograph of a child is not a celebration but a liability laid down for a future we could already see (How Photos on a School Facebook Page Have Become AI Training Data).

None of that was prophecy, it was foreseeability, and I use that word deliberately because it carries legal weight. A foreseeable risk is one that a reasonable person could have anticipated and taken steps to prevent. This risk was foreseeable. It was named. I have been naming it for years.

I have been calling this risk out since I completed the very first digital risk review and social media audits for schools in 2016!! and still it took a worst-case scenario, real children turned into abuse material and a ransom demand landing on a school’s desk, before the sector was willing to listen. That is the part that sits heaviest with me as we did not lack the warning. We lacked the will to act on it before it became unbearable.

The scale is not hypothetical either. In 2025 the Internet Watch Foundation assessed 8,029 AI-generated images and videos as realistic child sexual abuse. The number of AI-generated videos rose from 13 in 2024 to 3,440 in 2025. That is not a gradual climb. That is a tool becoming widely available and easy to use, in the hands of people who need almost no technical skill to operate it.

The raw material they need is a clear photograph of a child’s face. Most school websites built in the last five years contain exactly that, hundreds of times over.

This is not just a photo problem. A photo problem has a tidy solution. You change a setting, you update a consent form, you move on. What you are actually facing is a convergence of three things that schools have historically treated as separate. It is a safeguarding matter, because the harm is to a child. It is a security matter, because it follows the playbook of extortion and ransomware. And it is a governance matter, because the question of who is responsible, what the protocol is, and what happens when the demand arrives is a question of duty of care. If your safeguarding framework, your incident response, and your communications policy do not currently meet in the same room, this is the threat that will force them to.

There are now two conversations every school needs to have right now.

The first is prevention, and here the guidance is clear.

Stop publishing face-on identifiable photographs of pupils. Replace them with distance shots, with blurred images, with photographs taken from behind. Stop pairing names with faces. Review your privacy settings. And audit every image currently live on your website and your social media accounts before the end of term, because the ones already published are the ones already exposed. Many schools that I work with have done exactly this, once the threat became real to them. Most schools have not yet started.

The second conversation is the one almost nobody is having.

What is your online crisis management protocol for the day the demand actually arrives? Who opens that email. Who do they call first. Do they know not to pay, and do they understand that paying funds the next attack and guarantees nothing in return. Do they know to preserve the evidence, who to contact, to get those images hashed and blocked rather than quietly deleted in a panic. Most schools have no answer to any of this, because they have never been asked to imagine it. I am asking you to imagine it now, while you still have the time to prepare calmly rather than in the middle of the worst day of someone’s career.

Here is the simplest thing you can do today. Go to your school website and count how many face-on photographs of named pupils are publicly visible. That number is the size of your exposure. Then ask yourself an honest question. If one of those children’s images was turned into abuse material tomorrow, and a parent sat across from you asking how it was possible, or worse a child walks in with their lawyer in years to come because you were the publisher of the image they want to hold you accountable,  how would you explain that the photograph came from a page you controlled, about a risk that had been documented for years.

I do not write any of this to frighten you (even though you probably are). Fear makes people freeze, and freezing is the opposite of what these children need from the adults around them. I write it because the work of protecting them is entirely doable, and because clarity is kinder than alarm. The biggest part of my work is helping schools rebuild their safeguarding and online safety frameworks to account for AI-enabled risks like this one, including the image audits and the response protocols that most schools have never had. The way I can best describe what sits underneath that work is the Ctrl+Shft operating system, which is the nervous system schools have been missing. Over the next few months it will replace a number of things, including existing whole school compliance management systems, for a fraction of the cost. It is not another platform sitting on top of all the others. It is a living prevention, governance, and intelligence layer that senses what is emerging, interprets what it means for your school community, and helps you respond with calm and foresight before harm has the chance to take hold. We provide the intelligence. The response is always yours.

If you would like a free initial report generated by our Ctrl+Shft+Radar, along with a second pair of eyes on your image and AI policies, you can reach me confidentially and directly at kirra@safeonsocial.com and I will get to work.