Bristol City Council Schools Cyber Attack: What We Know and What to Do

What has been reported so far

The account below comes from several news outlets and rests largely on what Bristol City Council has told journalists. We could not find a council statement page to link to, so treat these details as reported rather than officially published by us or verified by us.

The platform at the centre of this is Trading with Schools, an IT service the council provides to schools. Reports describe it being used for scheduling, lesson plans, staff records and payroll. It is also reported to be capable of holding sensitive information about children, including educational psychology files.

• Platform: Trading with Schools, run by Bristol City Council for schools.
• Scale of use: reported as 88 schools. Of those, 39 are reported to have had personal data taken. One report says the other 49 use the platform for internet services only.
• Published data: more than 320,000 files reported as found on the dark web on or around 4 November 2026.
• Contents: the council has said it cannot yet confirm what the published information is, or which schools, families or individuals it relates to.
• Investigation: reports name cyber security specialists, Avon and Somerset Police and the South West Regional Organised Crime Unit.
• Day-to-day impact: one report says many schools have been unable to use their phones since the shutdown, and that teachers have faced longer working hours.

Timeline of reported events

Dates below are as reported. Where outlets differ we say so. The gap between the attack and the publication of data is the part we would expect to be refined as the investigation continues.

• 21 September 2026: the Trading with Schools platform is reported to have been infiltrated by malicious software.
• 25 September 2026: the council is reported to have become aware of the incident four days later and shut the platform down. Internet access at schools was suspended as a precaution; early figures put this at around 80 schools.
• September to October 2026: schools worked without the affected services while the council, specialists and police investigated. One security bulletin also mentions local reports of exported records at a single primary school. We could not corroborate that and have left it out of the account above.
• 27 October 2026: a ransomware group calling itself Wallstreet is recorded by threat-tracking sites as listing Bristol City Council on its leak site. See the next section for why this is not the same as confirmation.
• 4 November 2026: the BBC, ITV, LBC and The Independent report that more than 320,000 files stolen in the attack have been published on the dark web. Council officials say they are working through a large amount of material as quickly as possible.

What is confirmed and what is not

Several things are consistently reported across outlets: the 21 and 25 September dates, the 320,000-file figure, the 39 schools with data taken and the involvement of specialists and law enforcement. The council has also acknowledged it cannot yet say what the published files contain.

Other points are less settled. The Wallstreet listing exists on leak-site trackers, but those trackers are repeating the attacker's own claim. The listing came with no samples or technical detail that we have seen, and the council has not attributed the incident to that group. A threat-tracking bulletin also notes that no public evidence links the listing to the schools incident. Until the council or police say otherwise, we would not name an attacker.

School numbers also vary between reports (around 80 schools with internet suspended, 88 on the platform, 39 with data taken). These figures describe different things and are easy to blur together. We have not found a public statement saying the council has notified the Information Commissioner's Office (ICO) or the affected individuals, so we make no claim either way.

If you are a parent, carer or member of school staff

The council and schools are asking people to stay alert while the contents of the files are established. Published school data tends to fuel convincing scam messages, because the sender can sound as though they know something about you or your child. The steps below are sensible whether or not your data turns out to be in the files.

1. Wait for your school's communication and follow it. Head teachers of affected schools have been informed and are reported to be issuing guidance. Be wary of anyone contacting you about the incident who you did not expect, including messages claiming to be from the school, the council or the police. If in doubt, contact the school using a number you already trust rather than one in the message.
2. Do not click links or open attachments in unexpected emails or texts, and do not give details out over the phone to an unexpected caller.
3. Report suspicious emails by forwarding them to the NCSC (the address is on the NCSC page listed in our sources). Reports on the incident also cite 7726, the free text service for forwarding suspicious texts to your mobile provider.
4. Use a strong, unique password for each important account and turn on multi-factor authentication (a second check, such as a code from an app, in addition to your password) where it is offered.
5. Keep an eye on bank and online accounts for activity you do not recognise. If you have lost money or think an account has been taken over, report it through the official fraud reporting service.

Practical lessons for UK organisations

This section is our interpretation, not a finding about what went wrong in Bristol. The cause and entry method have not been publicly established, and we are not suggesting any particular failing. These are the lessons we think transfer to any organisation that runs or relies on a shared platform.

A shared platform has a shared blast radius. One service used by dozens of organisations means one incident can affect all of them at once. If you are the provider, think about how tenants are separated and what a single compromise could reach. If you are the customer, ask your supplier the same question. The NCSC supply chain guidance is a good starting point for setting minimum security expectations with suppliers.

Know what the platform holds. Reports describe a service that started with scheduling and payroll but also held educational psychology files. Data tends to collect wherever it is convenient to put it. A short, honest inventory of what sits in each shared system, especially special-category or child data, shapes both how it is protected and how fast you can tell people what was exposed.

Shutting down early costs you something. Taking a platform offline within days is a reasonable containment decision, and the reported impact on schools' phones and staff workload shows what it can cost. Decide in advance who has the authority to take a critical service offline, and what the fallback is for the people who depend on it.

Plan communications for when your normal channels are down. The NCSC incident response guidance recommends at least two contact methods for each key person and out-of-band communication, meaning a route that does not depend on the network or email systems that may be affected.

Be ready to say what you do not know. The council's statements have been careful to say the contents are not yet confirmed. That is hard when parents want answers, but it avoids having to retract guesses later.

Treat breach reporting as a clock. Under UK GDPR, a notifiable personal data breach must be reported to the ICO within 72 hours of becoming aware of it, and if the breach is likely to result in a high risk to individuals they must be told directly and without undue delay. All breaches should be recorded, whether or not they are reported.

What to watch for next

The most useful updates will be the council's confirmation of what was published and which individuals are affected, any statement of attribution from the police or the council, and whether the ICO is formally involved. Until then, assume figures and details can change. If you are a school or a council supplier, check whether any shared service you use holds data on your behalf and whether the provider has told you anything about this incident.