320,000 Files From Bristol Schools Published on the Dark Web: What the Trading with Schools Attack Means for Every School and Council

On Tuesday 3 November 2026, parents and carers at 39 Bristol schools were told that files taken from their children's schools had been published online by criminals. Bristol City Council now puts the number at approximately 320,000 files. They came from Trading with Schools, a council-run service that supplies IT to 88 schools in the city, which was attacked in September and shut down on 25 September.

The council does not yet know what is in the files or whose information they contain. That uncertainty, six weeks after the attack, is the hardest part of the story for the families involved, and it is also the part that other schools, trusts and local authorities should study most closely.

What Happened

Trading with Schools provides Bristol schools with shared IT infrastructure and related services. Of the 88 schools connected to it, 49 use it only for internet access, according to Silicon UK, while the other 39 rely on it for day-to-day work including scheduling, lesson plans, staff records, payroll and pupil information.

The council first suspected a problem on 21 September, The Independent and TechRadar report, and shut the service down on 25 September. All 88 schools were disconnected from the network. Many lost access to digital tools and, in some cases, their telephone systems, and have been working around the outage since. Schools stayed open throughout.

In October the council confirmed that malware had been planted, but council leader Tony Dyer told the BBC that the investigation "had not identified any evidence that data has been stolen", TechRadar reports. That changed at the end of the month. IT Pro reports that a ransomware group calling itself Wallstreet, which appears to have been operating since June and claims 47 victims, listed Bristol City Council on its leak site on 27 October. According to the council's own account, officers learned on Friday 30 October that data had been stolen and published online. The 39 schools believed to be at risk were told that day, and parents and carers were informed through their schools on 3 November.

The council's incident page now says approximately 320,000 files may have been taken and made available online. "We understand that people will want answers about what information may have been affected," said Vik Verma, the council's director of education and skills, adding that officers were "working through a large volume of material as quickly as possible". The council says it is "not possible to confirm all schools or individuals affected by the theft" at this stage.

The council is working with Avon and Somerset Police, the South West Regional Organised Crime Unit and the National Cyber Security Centre, and has reported the breach to the Information Commissioner's Office. It will not comment on who is responsible while the investigations continue. On one point it is direct: "We have not paid and do not intend to pay a ransom." It also says a breach of the management information system at Southville Primary School is being investigated separately, and that there are signs the same criminals may be responsible, although that is not confirmed.

Who Is Affected

Potentially, pupils, parents, carers and staff connected to the 39 schools, past as well as present. The council has published a list of those schools and says schools not on it are unlikely to be affected. Beyond that, it cannot yet say whose data is in the files or what kind of data it is.

The reason for concern is what a school IT service typically holds. Press reports point out that the service could store sensitive material such as educational psychology files alongside staff and payroll details. If records of that kind are among the published files, the consequences go beyond the phishing and fraud risk the council has rightly warned about and into safeguarding. The council says it cannot yet confirm whether risks have increased, that safeguarding is a top priority and that it is working with the police and health services.

Its advice to families is practical and worth repeating: do not look for the published data, be wary of unexpected emails, texts and calls, never share passwords or bank details in response to them, use different passwords for different accounts, and turn on multi-factor authentication or passkeys where available. Specialists do not currently expect more data to be published, the council says, although it cannot guarantee that.

Why It Matters

Three features of this incident apply to almost every school and local authority in the country.

The first is the shared service. Eighty-eight schools were disconnected because one platform was attacked. Pooling IT through a council, a multi-academy trust or a managed service provider makes sense for schools that could never afford their own specialists, but it also means one intrusion becomes everyone's outage and one data store becomes everyone's breach. Few individual schools would be able to say what a shared provider holds on their behalf, how it is backed up or how quickly they would be told if something went wrong.

The second is the gap between "no evidence of data theft" and proof of it. For roughly a month the working assumption was that data had not been taken. The first confirmation came not from the investigation but from the criminals publishing the files. That is a familiar pattern. Finding no evidence that data has left is rarely the same as establishing that it has not, particularly when logging is incomplete, and communications to parents and staff should be written with that in mind. Rebecca Moody of Comparitech also pointed out to IT Pro that four days passed between the first suspicious activity and the shutdown, time in which intruders could move through systems and copy data.

The third is the refusal to pay. The council's statement that it has not paid and will not pay is consistent with the direction of UK government policy on ransom payments by public bodies, which we cover in our guide to the UK ransomware payment ban. It is the right position, but it carries a cost that has to be planned for: if payment is off the table, publication of stolen data should be assumed, and the organisation needs to be ready for it.

A Separate Case Shows What These Intrusions Look Like

By coincidence, on 3 November Bitdefender published a detailed analysis of a ransomware attack on what it describes only as "a school estate in the UK", carried out between 10 and 19 September by an affiliate of the 3AM ransomware group. Nothing published links that report to Bristol, and it should not be read as an account of the Bristol attack. It is useful because it shows the anatomy of such an intrusion.

According to Bitdefender, the attackers began by reading stored credentials from three backup servers. They mapped the network, created two backdoor administrator accounts, copied files from a finance share and then spent around three hours building trust relationships between school domains that had previously been separate, so that one set of credentials would work everywhere. On the final morning they tried and failed to remove the security software, then encrypted about 37 of roughly 50 machines in 26 minutes. Bitdefender believes many of the commands were generated by an AI model, but is careful to present that as a working model rather than an established fact, and it could not determine how the attackers first got in. Its recommendations are established ones: separate administrator credentials for each domain, isolated backups with immutable copies and security software on every machine.

What To Do Now

Ask your shared IT provider three questions. What data of ours do you hold, including old files and backups? How is it separated from other schools' data? How and when would you tell us about an incident? Get the answers in writing, whether the provider is a council, a trust central team or a commercial supplier.

Protect backups as a target. Keep at least one copy offline or immutable, where no network account can delete it, and give backup systems their own credentials. In the Bitdefender case the backup servers were the first thing attacked.

Keep school networks separate. Shared services should not mean shared administrator accounts. Use separate administrative credentials for each school or domain, and treat any new trust relationship or administrator account as a change that needs approval and raises an alert.

Turn on multi-factor authentication everywhere it is offered, starting with email, the management information system, remote access and anything used by administrators.

Reduce what is stored. Records such as educational psychology reports, safeguarding notes and old payroll files should be kept only where they need to be, for only as long as required, with access limited to the people who need them.

Plan to operate without IT. Bristol's schools stayed open with no network and, in some cases, no telephones. Know how you would take registers, contact parents, run payroll and handle safeguarding referrals on paper and mobile phones for several weeks.

Prepare your communications. Draft the letter to parents and staff before you need it, avoid reassurance you cannot support with evidence, and remember that a breach involving personal data must be reported to the ICO within 72 hours of becoming aware of it.

How Cybergen Can Help

Cybergen works with schools, trusts and public bodies through our education sector practice. Our 24/7/365 managed detection and response service is designed to catch the early stages of an intrusion, and our incident response service supports organisations through investigation, recovery and notification.

Frequently Asked Questions