Cyberattack on Bristol schools leads to the online leak of more than 320,000 stolen files from 39 schools
Officials warn students, parents, and staff to expect phishing attempts and other fraud using exposed data
Investigation continues as authorities determine whose information was compromised and the extent of the breach
Threat actors have leaked hundreds of thousands of records they stole from Bristol schools in September 2026 onto the dark web. Bristol city council has issued a warning urging both students and parents to expect phishing attacks and other internet scams, and to be vigilant with incoming communications. “Following ongoing investigations into the cyber-attack affecting the school’s IT network, evidence has been found that data taken during the incident has been published online by the criminals responsible for the attack,” the council said in a new statement. “Specialist investigations have identified a significant number of files believed to have been taken from the network and made available online.” Data leaks online
Reports of a cyberattack against Trading with Schools (TwS), a service operated by Bristol City Council providing schools with shared IT infrastructure and a range of administrative and operational support services, including financial administration, payroll, HR, and more, emerged in October 2026. At the time, the council said it first suspected foul play on September 21, and decided to shut down the service four days later, on September 25. Following an initial investigation, it was discovered that someone had planted malware , and that the breach affected 87 schools. Back then, council leader Tony Dyer told the BBC that the investigation “had not identified any evidence that data has been stolen.” However, it seems that not only that the data was stolen – it also leaked on the dark web. Usually, leaks follow a failed extortion attempt, but we don’t know who the threat actors are or if they actually tried to get the council to pay for the data…