More than 320,000 files stolen during a cyber attack on Bristol City Council's schools server have surfaced on the dark web, prompting investigations by police and cybersecurity specialists. The breach affected 39 schools using the council's Trading with Schools platform, which was compromised in September. According to BBC News, the council is working to determine what personal data was published and which individuals may be affected.
The Trading with Schools system was infiltrated by malicious software on 21 September, though Bristol City Council did not discover the attack until four days later. The authority shut down the platform on 25 September after becoming aware of the breach. Head teachers at the affected schools have been notified and are providing guidance to families. According to ITV News, the council is collaborating with Avon and Somerset Police, specialist cybersecurity advisers and the South West Regional Organised Crime Unit to investigate the published files.
Vik Verma, director of education at the authority, stated that officers were
"working through a large amount of material as quickly as possible"to establish the nature of the data published and would provide updates to families in due course. The council acknowledged that it cannot yet confirm all schools or individuals affected, as investigators are auditing the files to identify who may be impacted.
What data was at risk?
The Trading with Schools platform serves 88 schools under the council's umbrella. Of these, 49 schools use the system only for internet services, while the remaining 39 schools—those whose data has been published—relied on it more extensively for day-to-day operations. The system housed information including scheduling, lesson plans, staff details and payroll records. The platform can also contain sensitive information about children, such as educational psychology files.
Since the system was shut down, many schools have struggled with operational disruptions. Teachers have faced longer working hours as they sought alternative ways to deliver lessons, and numerous schools have been unable to use their phone systems. The BBC understands that only Bristol schools were impacted by the breach.
How does data end up on the dark web?
The dark web is a hidden section of the internet not indexed by standard search engines and accessible only through specialist software. Dr John Curry, a reader in cyber security at Bath Spa University, explained that while the dark web has legitimate uses, it is predominantly used for illicit activities. He described how criminal syndicates typically operate in such breaches: they extract data and pass it to brokers who attempt to monetise it.
Dr Curry elaborated on the process:
"They chop it up into chunks and decide who could use this - 'if you buy this from us, you could use it to blackmail teachers and parents who have people at the school, you buy this set from us you might be able to use it for financial data'."Once data has been sold to interested buyers, criminal groups often dump the entire dataset online to demonstrate their capabilities to other potential clients and attract future work.
What happened before this discovery?
On 5 October, council leader Tony Dyer stated that the council's analysis had not identified evidence that data had been stolen. The subsequent discovery of files on the dark web contradicted that earlier assessment and prompted the current investigation. The South West Regional Organised Crime Unit is now leading the inquiry into the cyber attack.
This incident follows a pattern of significant education sector breaches in the UK. In July 2026, hackers obtained about 607,000 records in a cyber-attack on the Department for Education in England, affecting contact details though not bank or sensitive data. Additionally, hackers stole data from 3,300 people, mostly children, by exploiting a test account protected by the weak password "Password1" that had remained active for 12 years.
What guidance has been issued?
Verma acknowledged the distress the breach could cause the school community and emphasised that the authority's key focus was determining
"what information may have been affected and whether it relates to them or their family".The council is ensuring schools, families and staff receive
"clear advice on the practical steps they can take to protect themselves online".
Families and staff are advised to remain vigilant and follow these protective measures: be cautious of unexpected emails, text messages and phone calls, even if they appear to come from a trusted organisation; avoid clicking on links or opening attachments in unexpected messages; be wary of requests to reset passwords, verify account details or provide personal or financial information; use strong and unique passwords on important online accounts and enable two-factor authentication where available; monitor online accounts and bank statements for any unusual activity; and report suspicious emails to report@phishing.gov.uk and suspicious text messages to 7726.
What happens next?
According to ITV News, the council and cybersecurity advisers are continuing to review the published material to establish what information it contains and which schools or individuals are affected. No completion date for this review has been reported. The investigation by police and specialist agencies is ongoing, with further updates expected as the audit of the stolen files progresses.
