Bristol’s school files are now online. The leak came six weeks later.

Files stolen in September’s cyber attack on Bristol’s schools have now been published online. Bristol City Council says investigators have found a “significant number of files” taken from its Trading with Schools platform, and reports put the total at more than 320,000. It’s the next chapter of the Bristol schools data breach, and it arrived six weeks after the attack itself.

The council believes the theft affected 39 schools that use the service. A further 49 schools on the same platform are not thought to have been directly affected. It says it can’t yet confirm which schools or individuals are in the published material, and is working through it with cyber security specialists, Avon and Somerset Police and the regional organised crime unit.

What the platform held

Trading with Schools runs day-to-day jobs such as lesson scheduling and payroll, and it can hold sensitive records, including educational psychology files. The council hasn’t said what is in the leaked files. Schools have sent parents, carers and staff guidance: be cautious of unexpected emails, texts and calls, don’t click links or open attachments you weren’t expecting, and keep an eye on bank statements and online accounts.

The timeline matters. Suspicious activity was spotted on 21 September and the platform was shut down on 25 September. When I wrote about the attacks in October, the council said there was no evidence of a mass export of data from the wider schools network. Now the files are out.

“No evidence of data theft” describes what you know today. It isn’t a promise about next month.

Ashley Adkins, fromIT

Three lessons for your business

1. Plan as if the data was copied. Criminals often take data quietly, then publish it weeks later when the pressure to pay hasn’t worked. If you have a cyber incident, don’t wait for proof of theft before warning people. Tell staff and customers what to watch for early. You can always update them with good news.
2. Know what each system holds. Six weeks on, the council still can’t say who is affected. That’s not unusual, and it’s the hardest part of any breach. If you can list what lives in your payroll, HR, CRM and shared drives, you can tell people and the ICO quickly. If you can’t, you’ll be reading through stolen files to find out.
3. Expect the scams that follow. Payroll and staff details make convincing bait: a “payroll correction” email, a call about a pension, a fake invoice that quotes a real name. The leak is often the start of the fraud, not the end of the incident.

What to do this week

• Pick your three most important systems and write down, in one line each, what personal data they hold and who can get into it.
• Check how you’d report a breach to the ICO. You normally have 72 hours from becoming aware of it, and that clock doesn’t wait for the full picture.
• Tell your team that any message about pay, bank details or pensions gets checked on a known number before anyone acts on it.
• If a supplier holds your staff or customer data (payroll, HR, IT), ask them how they’d tell you if it was stolen.

Leaked data also tends to turn up in criminal markets long after the headlines. fromIT’s dark web monitoring watches for your business’s email addresses and tells you when they appear.

If you work with Bristol schools

If you’re a parent, staff member or supplier, follow the guidance your school sends and be wary of any message that mentions the attack, a refund or a “data check”. Criminals use the news itself as a hook. If something already looks wrong on your own systems, treat it as a cyber incident and get help quickly.

Sources

• ITV News West Country: 320,000 files leaked online by criminals in Bristol schools cyber-attack (4 November 2026)
• Tes: Cyberattack leads to online leak of schools’ data (November 2026)
• AOL: Hackers steal 320,000 UK school files and publish them on dark web (November 2026)