Bristol school data breach: 320,000 files remain unexplained
Investigations continue into what specific information was stolen from the Trading with Schools network in September.
By Jasmine Carter ·
A cybersecurity incident affecting the Bristol school system has left parents and staff waiting for clarity on the extent of the damage. The breach, which occurred on September 21, targeted the Trading with Schools IT network used by local educational institutions.
Bristol City Council stated that approximately 320,000 files have been located on the dark web. The council identified 39 schools that may be impacted by the theft, although being on the list does not confirm that data was specifically taken from those sites. Parents and carers were notified of the breach on November 3, four days after the council was informed that the data had been uploaded online.
The specific content of the stolen files remains unknown. An audit is currently underway with the help of specialists from Avon and Somerset Police, the South West Regional Organised Crime Unit, the National Cyber Security Centre, and the Information Commissioner's Office. The council has not yet determined if the files contain personal details of pupils or parents. Officials noted that establishing exactly which individuals are affected is a top priority of the forensic review.
The timeline of the breach has drawn scrutiny. Suspicious activity was detected on September 21, but schools were not disconnected from the compromised network until September 25. Malicious software was believed to be installed on some devices during that four-day window. It is unclear if a faster response would have prevented the data theft. The council has stated it has not paid a ransom and does not intend to do so. There are unconfirmed signs that the same group may have also targeted the management information system at Southville Primary School.
Professor Phil Legg of the University of the West of England explained that data on the dark web is difficult to remove. He noted that attackers often upload large datasets to prove their capabilities rather than to sell them immediately. While the data could be used for identity fraud or extortion, there is no certainty that anyone will buy it or act on it. Legg advised individuals to remain vigilant against suspicious emails and to use unique passwords and two-factor authentication for critical services.
Bristol City Council has not yet announced new security measures for the network. The incident has been reported to the Information Commissioner. Schools have been advised to file precautionary reports and work with their own data protection services. The council said it is actively engaged with safeguarding partners, including police and health services, to assess any risks to student safety.
The council referred to its previous statement when asked for further comments on the ongoing investigation. That statement included the list of the 39 schools that may be impacted. No additional details on the cause of the breach or the identity of the responsible party have been released.
