Bristol Schools Breach: 320,000 Files on Dark Web, Council Still Can't Say Who's Affected

More than 320,000 files stolen from Bristol City Council's school IT platform have been published on the dark web, the council has confirmed. The attack targeted the council's Trading with Schools platform in September 2026. The council says personal data was stolen from 39 schools using the platform. Other reporting puts the figure at 88 schools. The BBC understands only Bristol schools were impacted.

The council has not yet confirmed exactly which schools or individuals had information stolen. That gap matters. The files are already circulating. Parents and schools are working without a definitive list of who is at risk.

Exposed records may include children's educational psychology files and staff payroll data, according to reporting on the breach. The council has not confirmed the nature of the data. Head teachers have been informed and are issuing guidance to families. Vik Verma, the council's director of education and skills, urged parents and carers to be cautious of unexpected messages, emails or phone calls and to follow guidance shared through schools.

The council is working with schools, cyber security specialists, Avon and Somerset Police and the Regional Organised Crime Unit.

For security teams, the incident reinforces a familiar pattern: third-party platforms holding sensitive data become single points of failure. The delay in confirming affected individuals is common when forensic scoping is incomplete, but it leaves families exposed to targeted phishing and fraud while the data is already available.

What defenders should do:

Until then, the practical advice remains: treat unexpected contact as suspect, and wait for verified guidance from schools.