Bristol City Council: hackers steal 320,000 files from 39 schools via Trading with Schools platform and post to dark web
Severity: high · Patch status: no-fix-needed · Since 2026-11-04
Hackers targeted Bristol City Council's Trading with Schools platform in September 2026, accessing data from 39 schools across the Bristol region. Specialist investigations have now identified that at least 320,000 stolen school files have been published on the dark web. The council is running specialist investigations into the breach; no attacker group, CVE, or remediation details are given in the source. Affected organisations are the schools whose data was held on the platform, and individuals whose records were among the stolen files. As a data breach, there is no vendor patch to apply; response centres on investigation, notification, and dark-web monitoring.
What to do
- Schools and individuals potentially affected should monitor for misuse of personal data and be alert to targeted phishing using stolen details
- Review what data is shared with or hosted on council-run education platforms and minimise sensitive data exposure
- Ensure council-hosted education platforms enforce MFA and access logging
- Coordinate with the council and NCSC/ICO on incident response and notification obligations
- Monitor dark-web leak sites for further publication of related data
Sources
All live incidents on Threat Watch
