News · Breach Analysis · Breaking

Bristol school data breach: 320,000 files published on the dark web

Files stolen from Bristol City Council's Trading with Schools platform, covering 39 schools, have been found on the dark web.

Mark FermorCTO, CMO and Founder, Firevault

Published 4 November 2026 · 3 min read

More than 320,000 files stolen in a cyber attack on Bristol City Council's schools server have been found on the dark web, BBC News reported on 4 November 2026.

What happened

Bristol City Council said the personal data was taken from 39 of the schools that use its Trading with Schools platform. According to the BBC, the platform was infiltrated by malicious software on 21 September 2026. The council became aware of the attack four days later and shut the system down on 25 September.

The council said it was unable to confirm the details of the published data at this time. Head teachers have been informed and are issuing guidance to families at the affected schools.

Who is affected

The platform serves 88 schools under the council. Of those, 49 buy only internet services. The remaining 39, whose data has now been published, rely on the system for scheduling, lesson plans, staff records and payroll information. The BBC reported that the platform can also hold sensitive information about children, including educational psychology files.

Since the shutdown, many schools have reportedly been unable to use their phones, and teachers have faced longer working hours to deliver lessons.

What the council and experts said

Director of education Vik Verma said officers were "working through a large amount of material as quickly as possible" to establish what was published, and would update families in due course. He encouraged everyone to "remain vigilant, be cautious of unexpected messages, emails or phone calls".

Dr John Curry, a reader in cyber security at Bath Spa University, told the BBC that crime syndicates typically extract data and pass it to brokers, who split it into chunks for blackmail or financial fraud, and that full dumps are often published to show other criminals what a group is capable of.

The South West Regional Organised Crime Unit is investigating.

Why this matters for schools

Schools hold some of the most sensitive records in any community: safeguarding notes, special educational needs assessments, staff payroll and family contact details. When those records sit on a shared, always-connected platform, one compromise reaches every school that depends on it. The month-long outage also shows that recovery is about more than data; it is about how quickly teaching can continue.

Practical steps for families and staff

The council's advice, as reported by the BBC, includes:

• Be cautious of unexpected emails, texts and phone calls, even from apparently trusted organisations
• Avoid clicking links or opening attachments in unexpected messages
• Be wary of requests to reset passwords or provide personal or financial details
• Use strong, unique passwords and enable two-factor authentication
• Monitor accounts and bank statements for unusual activity
• Report suspicious emails to report@phishing.gov.uk and suspicious texts to 7726

Where physical disconnection helps, and where it does not

Physical disconnection does not protect a live platform that schools use every day, and it would not have prevented this intrusion. What it can do is keep retained copies of the most sensitive records, such as archived safeguarding and psychology files, physically offline when they are not being accessed. If data is connected, it can be reached. Records that do not need to be online every day can be stored so they cannot be reached remotely, and backups held offline give a clean point to recover from. Read more about Offline Secure Storage® for business data.

Source: BBC News, "Hackers publish 320,000 school files on dark web", Mike Gilmore, 4 November 2026