Hackers Published 320,000 Files Stolen From 39 Bristol Schools, and the Council Still Can't Say What's in Them

Six weeks after hackers broke into the system Bristol's schools run on, the stolen data is out in public. More than 320,000 files have turned up on the dark web, and Bristol City Council says it cannot yet tell families what is in them.

The files come from 39 schools that use the council's Trading with Schools platform. Only Bristol schools are understood to be affected.

Four days to notice

Malicious software got into Trading with Schools on 21 September. The council only became aware four days later and shut the system down on 25 September. Sony needed the same four days to spot an intruder in its So-net member database last month, by which point 2.6 million customer records were gone.

Eighty-eight schools use the platform, but 49 of them only buy internet services through it. The other 39, the ones whose data has now been published, lean on it for much more: scheduling, lesson plans, staff details and payroll information. The platform can also hold sensitive information about children, including educational psychology files.

The council has not confirmed which kinds of records were in the leak. Vik Verma, its director of education, said officers are "working through a large amount of material as quickly as possible." The priority, he said, is working out "what information may have been affected and whether it relates to them or their family." He urged people to "remain vigilant, be cautious of unexpected messages, emails or phone calls."

Schools still running without systems

The damage started long before the leak. Since the shutdown, many schools have been unable to use their phones, and teachers are working longer hours to keep lessons going.

Head teachers have been briefed and are sending guidance to families. The advice is to be wary of unexpected emails, texts and calls, even from organisations that look trustworthy, to use strong unique passwords with two-factor authentication, and to keep an eye on bank statements.

How stolen school data gets used

Dr John Curry, a reader in cyber security at Bath Spa University, said attacks like this are usually carried out by crime syndicates that pass the data to brokers. "They chop it up into chunks and decide who could use this," he said.

He described sellers pitching those chunks to buyers who might use them to blackmail teachers and parents or to commit financial fraud. Once the data has been sold, he said, it is often dumped online in full to show other criminals what the group can do.

The South West Regional Organised Crime Unit is investigating. For now, the families of children at 39 schools know their data may be sitting on the dark web, and do not know what it says.

Some offers on this page may be paid placements or contain affiliate links.