On September 21, 2026, Bristol City Council’s Trading with Schools platform was hit by a cyberattack, resulting in over 320,000 files being posted on the dark web. Data from 39 of the 88 schools using the system was affected. The stolen files include staff records, payroll data, scheduling information, and educational psychology files for pupils. Bristol City Council and the NCSC are investigating. Affected families are being asked to watch out for unexpected messages.
What the Trading with Schools Platform Was
Trading with Schools was an administration system run by Bristol City Council and used by 88 local schools. It managed everyday tasks like scheduling, lesson planning, staff communication, payroll, and storing pupil records.
The system also stored educational psychology files. These are reports and assessments made when a child has learning difficulties, mental health issues, special educational needs, or behavioral concerns. This information is considered special category data under UK data protection law, so it requires extra care. If this kind of data is leaked, it could seriously harm a child.
Attackers got into the system on September 21 using malicious software. Bristol City Council shut down the platform on September 25, four days after discovering the breach.
Two Months of Silence, Then 320,000 Files
From September to November, the investigation continued. Schools were informed, and some guidance was given, but the full details were still unclear.
On November 4, investigators confirmed that over 320,000 files had been found on the dark web. The council says it is working through the material as quickly as possible to find out which files were published, what they contain, and which schools and people are affected.
That information is still unknown. The council has confirmed that 39 out of 88 schools were affected, but it cannot yet say which schools or which people have records in the leaked data.
Vik Verma, Bristol City Council’s director of education and skills, addressed families directly. “We recognize that news of a data theft linked to this cyber-attack will be concerning for parents, carers, school staff and the wider school community. We will keep schools, parents and carers updated as more information becomes available.”
What Was in the Files, and Why It Matters
Because staff payroll records were stolen, attackers may have access to salaries, National Insurance numbers, and possibly bank account details for teachers and other school staff. This information could be used for identity fraud, targeted phishing, or financial crime.
For children, having their educational psychology files exposed is a different risk. These reports include details about their private struggles, learning disabilities, mental health diagnoses, and family situations that led to referrals. These are not just records—they describe real children by name, sometimes in ways the children themselves may not know are in their files.
The concern about how this data could be misused is real. As we covered when looking at how a government system attack can expose the most vulnerable people, sensitive records held by public bodies create specific risks; the individuals named in them often have no way of knowing their data was there, let alone that it’s been stolen.
What Happens to Data on the Dark Web
One of the first questions parents and staff will have is whether the files can be taken down.
The truth is that files cannot be removed reliably or quickly. Once data is on the dark web, copies spread. Investigators can find where some files appeared, but no organization can promise to remove every copy from every place.
This is why the question of whether your data can be removed from the dark web matters here; in short, the goal is to limit the harm rather than erase the data.
The council has confirmed it is working with cybersecurity specialists, schools, and law enforcement partners. The National Cyber Security Center (NCSC) has previously warned about exactly this type of attack on education. Its deputy director, Sarah Lyons, has said that attacks on schools, colleges and universities “could disrupt learning and put sensitive information at risk” and, in this case, that prediction has materialized.
This Attack Is Part of a Wider Pattern
Bristol’s schools are not the only ones affected. 2026 has been a tough year for education across the UK.
In July, the Department for Education confirmed a breach by the ExfilSquad hacking group, which leaked 607,000 records, including contact details of head teachers, university staff, and government officials. In 2025, Kido International nurseries were targeted, with photographs and personal details of thousands of children posted briefly to a dark web leak site.
About a quarter of further education institutions in the UK say they face a breach or attack at least once a week, according to the government’s Cyber Security Breaches Survey. More than half of schools reported an attack or breach in the past year. Schools keep a lot of data on children, families, and staff, but many have small cybersecurity budgets and old IT systems that are harder to protect.
The Trading with Schools attack is similar to other third-party supply chain breaches. Attackers do not always go after the main target directly. Instead, they attack a shared platform that many organizations rely on. If one system is taken down, attackers can access data from every organization that used it.
What to Do if You’re Affected
If your child attends one of the 39 affected Bristol schools, or if you work in one, here’s what to actually do.
Watch your inbox carefully. Anyone whose email address is in the leaked data may be targeted with phishing messages that use details from the stolen files to appear legitimate. Treat any message that references your school, your child’s teacher, or specific details about your family with heightened suspicion, no matter how professional it looks.
Be cautious of phone calls too. Scammers sometimes use stolen data to run voice phishing (vishing) calls, claiming to be from schools, the council, or even the police. Don’t confirm personal information over an unexpected inbound call.
Contact your bank if your salary details were on the platform. If you’re a school staff member, your payroll records may include financial details. Alert your bank that your information may have been exposed so they can flag unusual account activity.
Report fraud immediately. If you believe your personal information is being misused, report it to Action Fraud at actionfraud.police.uk or call 0300 123 2040. For concerns specifically about data protection, contact the Information Commissioner’s Office (ICO).
Check for official updates. Bristol City Council has committed to keeping schools, parents, and carers updated through official school channels. Wait for guidance from your school’s head teacher rather than acting on information from unofficial sources.
For the full checklist of what to do when your data has been exposed online, our guide to responding to dark web data exposure walks through every step in order.
Frequently Asked Questions
How many files were leaked?
More than 320,000 files from 39 Bristol schools have been found on the dark web.
When did the hack happen?
The Trading with Schools platform was breached on September 21, 2026, and shut down on September 25.
What type of data was stolen?
Staff records, payroll information, timetables, lesson plans, and pupils’ educational psychology files.
Which schools are affected?
39 of the 88 schools that used the Trading with Schools platform are affected. Bristol City Council has not yet confirmed which specific schools or individuals had data leaked.
Can the files be removed from the dark web?
Removal is not reliably possible. The focus is on identifying what was published, limiting harm, and helping affected individuals protect themselves.
What should I do?
Watch for phishing messages referencing school details, alert your bank if you’re a staff member with payroll data on the system, and report any fraud to Action Fraud at actionfraud.police.uk.
