More than 320,000 files exposed on dark web after cyber attack on schools

More than 320,000 files containing potentially sensitive information have been discovered on the dark web following a cyber attack on a school administration system in Bristol, raising fears over the exposure of children’s records and families’ personal data.

Information was stolen from 39 schools after hackers infiltrated Bristol City Council’s Trading with Schools platform on September 21, using malicious software to breach the system.

The council said it was examining a large volume of material published online to establish precisely what information had been compromised. It has not yet confirmed the contents of the leaked files.

Vik Verma, the authority’s director of education, said officers were “working through a large amount of material as quickly as possible” to determine the nature of the data.

Head teachers at affected schools have been informed and are issuing guidance to families. Verma said the investigation was focused on identifying “what information may have been affected and whether it relates to them or their family”.

The Trading with Schools system was used by 88 schools under Bristol City Council, but 39 were affected by the breach. The platform supported routine administrative functions, including timetabling, lesson planning, staff records and payroll.

It also held sensitive pupil information, including educational psychology files, raising concerns that the stolen material could extend beyond basic contact details to private records about children’s needs and circumstances.

The discovery of the files on the dark web adds a potentially more serious dimension to the incident. The hidden part of the internet can be accessed using specialist software and has legitimate uses, but is also associated with criminal marketplaces and the trading of stolen information.

Dr John Curry, a cyber security lecturer at Bath Spa University, said attacks of this kind were often carried out by criminal syndicates that extract data before passing it to brokers seeking buyers.

“They chop it up into chunks and decide who could use this,” he said.

The circulation of stolen information can create risks long after the initial breach, as criminals may use personal details for fraud, identity theft or targeted phishing attempts. However, the council has yet to establish what the published files contain or how they may be exploited.

Verma urged families to remain alert while the investigation continues.

“We would encourage everyone to remain vigilant, be cautious of unexpected messages, emails or phone calls, and follow the guidance being shared through schools,” he said.

The incident highlights the particular risks posed by cyber attacks on education systems, which can hold extensive personal information about children, parents and employees. Until the council completes its review, the full scale of the exposure — and the potential consequences for affected families — remains unclear.