Bristol City Council has confirmed that data stolen in a September cyberattack on its Trading with Schools platform has been published online. The BBC reports that more than 320,000 files have been found on the dark web, taken from 39 of the schools that use the platform. The council says it does not yet know exactly what information was published, which schools are affected, or which individuals are affected. Officers and outside cyber security advisers are going through the files now. No criminal group has been publicly named. The council, Avon and Somerset Police and the South West Regional Organised Crime Unit are investigating.
What Happened
Malicious software got into Trading with Schools on 21 September, according to the BBC. The council runs this platform, and the schools it manages use it for day-to-day operations. The council has said it first noticed suspicious activity that day. It disconnected the system four days later, on 25 September, and cut internet access to the affected schools to stop the malware spreading. Accounts differ slightly on how many schools were cut off. Early BBC reporting and the regional cyber crime unit said 87. Later council statements, ITV and the Bristol Post say 88.
The council's early public position was that no data had been taken. On 5 October, council leader Tony Dyer said its analysis had "not identified any evidence that data has been stolen." In its 15 October update, the council said there remained "no evidence of mass export of data from the Schools IT network." The publication of the files now contradicts both statements.
A second incident came to light on 15 October. The council said records had been exported from the management information system (MIS) at Southville Primary School, the system that holds pupil records. The council says the MIS is not hosted on the Schools IT network, but it believes the "same criminals" carried out both attacks. It has stressed that this link has not been confirmed. The Southville breach has been reported to the Information Commissioner's Office (ICO), and affected parents and carers have been told.
The disruption has been heavy. By 15 October, 84 of the 88 schools had limited internet access back, including all 39 schools whose IT the council supports directly. The BBC reports that many schools went without working phones for weeks and that teachers worked longer hours to keep lessons running.
What Was Taken
The council has not said what the published files contain. Director of education Vik Verma said officers were "working through a large amount of material as quickly as possible." In a statement reported by ITV, the council said: "At present, it is not possible to confirm all schools or individuals affected by the theft."
What is known is what the platform held. Of the 88 schools connected to Trading with Schools, 49 bought only internet services from it. The other 39 relied on it more heavily, for scheduling, lesson plans, school budgets, staff records and payroll. The BBC reports these 39 are the schools whose data was published. The platform can also hold sensitive information about children, including educational psychology files. It also held details of the schools' suppliers and trading partners.
The only confirmed figure is the 320,000+ files reported by the BBC. The number of people affected has not been disclosed. The council has not said whether the records exported from Southville Primary are among the published files.
Why It Matters
This is about as bad as a data leak gets for the people in it. The likely contents include payroll and staff identity data alongside special category data about children. Educational psychology records cannot be reissued like a password, and once they are public, they stay public.
Dr John Curry, a cyber security expert at Bath Spa University, told the BBC that groups like this often "farm" stolen data and sell it "in blocks" to other criminals. He named blackmail as a major concern. He also warned that supplier and ordering details could be used to divert or manipulate purchases of expensive equipment. That is a known route into invoice and payment fraud against schools and their suppliers.
For defenders, the incident shows three recurring problems:
- A shared service concentrates risk. One council-run platform serving 88 schools meant one compromise became a city-wide outage and a multi-school data leak.
- Early "no evidence of theft" statements can fall apart. The council's early assurances were later overtaken by the leak. Lacking evidence of exfiltration is not the same as having evidence that none happened, especially early in an investigation.
- Four days is a long time. The gap between first suspicious activity and disconnection is enough for attackers to stage and copy data out.
The Attack Technique
Few technical details have been released. The council has confirmed that malicious software was found on the platform and on some school devices. It has not said how the attackers got in, what kind of malware was used, or whether files were encrypted. The Bristol Post reports that some details are being withheld because of the live criminal investigation.
The sequence is consistent with a data theft and extortion operation: intrusion, a dwell period, data taken out, and then publication on a dark web leak site. No group has claimed the attack in public reporting, and the council has not said whether any ransom demand was made. How the Southville MIS was accessed, and whether the attackers used access gained in the September intrusion, are both still under investigation.
What Organizations Should Do
- Shorten the time from detection to containment. Set a threshold at which suspicious activity on a shared platform triggers isolation without waiting for full analysis. Rehearse it, so that cutting off dozens of sites is a planned action and not one made under pressure.
- Watch for data leaving, not just malware arriving. Monitor outbound traffic volumes, archive and compression activity, and connections to cloud storage or unfamiliar hosts. Without this, "no evidence of theft" claims cannot be relied on.
- Keep the most sensitive data apart from everyday systems. Educational psychology files, safeguarding records and payroll should not sit on the same platform as scheduling and lesson plans. Use separate storage, tight access control and access logging.
- Treat linked systems as exposed until proven otherwise. Bristol's MIS was hosted separately, but Southville's records were still exported. Rotate credentials and review access logs for every connected system, including third-party ones, after a compromise.
- Prepare people for the fraud that follows. Following the council's own guidance, warn staff and families about phishing, fake password reset requests and calls that claim to be from trusted bodies. Encourage two-factor authentication and close checking of bank statements. Report suspicious emails to [email protected].
- Lock down supplier payment processes. If supplier and order data has leaked, require callback verification on known numbers for any change to bank details or unusual orders.
Sources: Bristol schools hack sees 320,000 stolen files published on dark web | Southville Primary school in Bristol hit by targeted cyber-attack -... | Bristol City Council took four days to detect schools' cyber hack -... | Update on cyber incident affecting Bristol schools | Children's data leaked online by criminals in Bristol schools cyber... | Bristol Schools Cyber Attacks: Lessons for Your Business fromIT | Bristol council data breach - a Freedom of Information request to B... | Bristol primary school hit by second cyber attack as records export...