Hackers leak sensitive data stolen from 39 Bristol schools

320,000 files published on dark web

More than 320,000 files stolen in a cyberattack on a Bristol City Council education system have been published on the dark web.

The council said personal data had been taken from 39 schools using its Trading with Schools platform, which was compromised by malicious software in September.

Head teachers have been notified of the data leak and are advising families at the schools affected by the breach.

The authority said it was not yet able to confirm exactly what information had been exposed.

Vik Verma, the council's director of education, said officials were working through a large volume of material to establish the nature of the data that had been published.

He added that the families would be updated once more information became available.

According to BBC, the incident is believed to have affected only schools in Bristol.

Sensitive information at risk

The council's Trading with Schools platform is used by 88 schools across Bristol. While 49 schools used it only to purchase internet services, the remaining 39 relied on it for a wider range of administrative and operational tasks.

These included scheduling, lesson planning, maintaining staff records and managing payroll information.

The platform may also hold confidential records relating to students, including sensitive educational psychology assessments.

The attack took place on 21st September, although the council became aware of the breach four days later and shut down the platform on 25th September.

The disruption has affected the day-to-day running of schools, with many unable to use their telephone systems.

Teachers have also faced longer working hours as they attempt to find alternative ways of delivering lessons and managing administrative responsibilities.

Families urged to remain vigilant

Verma acknowledged the distress the incident could cause pupils, families and school staff across the city.

He said the council's investigation was focused on establishing what information had been affected and whether it related to particular individuals or their families.

The authority is working with schools to provide practical advice on protecting personal information and reducing the risk of further harm.

"We would encourage everyone to remain vigilant, be cautious of unexpected messages, emails or phone calls, and follow the guidance being shared through schools," Verma said.

Families and staff are advised to avoid suspicious links and attachments, be cautious about requests to reset passwords or disclose personal information, and use strong, unique passwords alongside two-factor authentication.

The South West Regional Organised Crime Unit is investigating the cyberattack.

Schools remain attractive targets for cybercriminals

Mat Pullen, director for education at technology company Jamf, said the publication of the files made the incident particularly concerning because of the sensitive nature of the information held by schools.

"What concerns me most here isn't the volume of information accessed, but whose information it is - this is far more serious than disruption to the school," he said.

"The sensitive data held by schools is the very reason they are attractive targets for attackers, along with their limited budgets and resources, especially when they have to choose between spending on security and on teaching."

"Schools need to be regularly reviewing their security measures, especially preventative steps that focus on cyber hygiene. This includes regularly monitoring systems and using threat prevention software that can combat cyber threats in real time."

The incident follows a cyberattack earlier this year on Higham Lane School in Nuneaton, Warwickshire, which forced the institution to close to pupils and staff for several days.