Technology Miraj Islam November 5, 2026 0 Comments

Hackers post more than 320,000 files stolen from 39 Bristol schools on dark web

Add us as a preferred source on Google

Subscribe to our newsletter

A cyber attack on Bristol schools leads to the online leak of more than 320,000 files stolen from 39 schools
Officials warn students, parents and staff to expect phishing attempts and other fraud using exposed data.
The investigation continues as authorities determine whose information was compromised and the scope of the breach.

Threat actors have leaked hundreds of thousands of records they stole from Bristol schools in September 2026 to the dark web.

Bristol City Council has issued a warning urging both students and parents to expect phishing attacks and other online scams, and to be alert to incoming communications.

“Following ongoing investigations into the cyber attack which affected the school’s computer network, evidence has been found that the criminals responsible for the attack posted data taken during the incident online,” the council said in a new statement. “Specialist investigations have identified a significant number of files believed to have been extracted from the network and made available online.”

Online data leaks

In October 2026 reports emerged of a cyber attack against Trading with Schools (TwS), a service operated by Bristol City Council that provides schools with shared IT infrastructure and a range of administrative and operational support services, including financial administration, payroll, human resources and more.

At the time, the council said it first suspected foul play on September 21 and decided to close the service four days later, on September 25. After an initial investigation, it was discovered that someone had planted malware and that the breach affected 87 schools. At the time, council leader Tony Dyer told the BBC that the investigation “had not identified any evidence that data had been stolen”.

However, it seems that not only was the data stolen, but it was also leaked to the dark web. Leaks typically follow a failed extortion attempt, but we don’t know who the threat actors are or if they actually tried to get the city to pay for the data.

The announcement does not put a figure on this “significant number” of files, but according to the BBC, there are more than 320,000 files, stolen from 39 schools.

At this time, no one knows the nature of the stolen data or to what extent it includes personally identifiable information (PII). Bristol City Council’s Director of Education and Skills, Vik Verma, said his officers were “working through a large amount of material as quickly as possible” to determine what was stolen, the publication wrote.

The BBC says the 39 schools whose data was stolen were “heavily” reliant on the system for day-to-day tasks such as scheduling, lesson plans, recording staff details and payroll information.

Therefore, students and alumni might not be the only ones worried about potential phishing attacks: school staff could also be targeted. To make matters worse, since TwS was closed, many digital tools and services are unavailable, making teachers’ jobs more difficult and prolonging their working hours.

The council notified Avon and Somerset Police and the Regional Organized Crime Unit, and engaged external cybersecurity advisers to assist with the investigation.

Only Bristol schools are affected

“At this time, it is not possible to confirm all schools or individuals affected by the theft,” the council said. “Officials are working to audit the released files and establish this picture as quickly as possible.” Apparently only Bristol schools were affected.

Parents and students are now advised to be wary of unexpected emails, text messages, and even phone calls, especially if they claim to come from a trusted source. They are also told not to click on links or open attachments in such messages, and to be wary of requests to reset passwords, “verify” account details, or otherwise provide personal or financial information.

They were also asked to use strong, unique passwords for important online accounts, turn on multi-factor authentication whenever possible, and keep a close eye on online accounts and bank statements.