- Cyberattack on Bristol schools leads to the online leak of more than 320,000 stolen files from 39 schools
- Officials warn students, parents, and staff to expect phishing attempts and other fraud using exposed data
- Investigation continues as authorities determine whose information was compromised and the extent of the breach
Threat actors have leaked hundreds of thousands of records they stole from Bristol schools in September 2026 onto the dark web.
Bristol city council has issued a warning urging both students and parents to expect phishing attacks and other internet scams, and to be vigilant with incoming communications.
“Following ongoing investigations into the cyber-attack affecting the school’s IT network, evidence has been found that data taken during the incident has been published online by the criminals responsible for the attack,” the council said in a new statement. “Specialist investigations have identified a significant number of files believed to have been taken from the network and made available online.”
Data leaks online
Reports of a cyberattack against Trading with Schools (TwS), a service operated by Bristol City Council providing schools with shared IT infrastructure and a range of administrative and operational support services, including financial administration, payroll, HR, and more, emerged in October 2026.
At the time, the council said it first suspected foul play on September 21, and decided to shut down the service four days later, on September 25. Following an initial investigation, it was discovered that someone had planted malware, and that the breach affected 87 schools. Back then, council leader Tony Dyer told the BBC that the investigation “had not identified any evidence that data has been stolen.”
However, it seems that not only that the data was stolen – it also leaked on the dark web. Usually, leaks follow a failed extortion attempt, but we don’t know who the threat actors are or if they actually tried to get the council to pay for the data.
The announcement does not put a figure to this “significant number” of files, but according to the BBC, it’s more than 320,000 files, stolen from 39 schools.
Right now, no one knows the nature of the stolen data, or how much of it includes personally identifiable information (PII). Director of Education and Skills at Bristol City Council, Vik Verma, said its officers were “working through a large amount of material as quickly as possible” to determine what was stolen, the publication wrote.
The BBC says that the 39 schools whose data was stolen “heavily” relied on the system for everyday tasks such as scheduling, lesson plans, recording staff details and payroll information.
Therefore, students and pupils might not be the only ones worrying about potential phishing attacks – school staff could be targeted, as well. To make matters worse, since TwS was shut down, many digital tools and services are unavailable making teachers’ jobs harder, and their working hours longer.
The council has notified Avon and Somerset Police and the Regional Organised Crime Unit, and has brought in third-party specialist cybersecurity advisers to help with the investigation.
Only Bristol schools affected
“At present, it is not possible to confirm all schools or individuals affected by the theft,” the council said. “Officers are working to audit the published files and establish this picture as quickly as possible.” Apparently, only Bristol schools were hit.
Parents and students are now being advised to be careful with unexpected emails, text messages, and even phone calls, and especially if they’re claiming to come from a trusteds in such messages, and to be wary of requests to reset passwords, “verify” account details, or otherwise provide personal or financial information
They were also told to use strong and unique passwords for important online accounts, and to turn on multi-factor authentication whenever possible, and to keep a close eye on online accounts and bank statements.
