More than 320,000 files taken from a Bristol City Council IT service used by local schools have turned up on the dark web, nearly six weeks after the platform was shut down. Parents and staff at 39 schools are being told to expect targeted scams while the council works out exactly whose data has gone.
What happened
Bristol City Council has confirmed that data stolen during the September compromise of Trading with Schools, the shared service it runs for local schools, has now been published by the attackers. The BBC reports that over 320,000 files were found on the dark web, drawn from 39 of the schools that use the platform. The council itself has described the haul only as a significant number of files and says it cannot yet tell which schools or individuals are affected.
According to the BBC’s timeline, malicious software got into Trading with Schools on 21 September. The council became aware four days later and shut the system down on 25 September, leaving many schools without phones and teachers working longer hours to keep lessons running. At the time, TechRadar reports, council leader Tony Dyer said investigators had found no evidence of data theft. That position has now been reversed.
The platform serves 88 schools under the council’s umbrella. Of those, 49 buy only internet connectivity. The other 39, the schools whose material has been published, lean on the service for daily administration: timetabling, lesson planning, staff records and payroll. The BBC notes the system can also hold sensitive records about children, including educational psychology files.
The council has notified Avon and Somerset Police and the South West Regional Organised Crime Unit and is working with them, with outside cyber security advisers. Vik Verma, the council’s director of education and skills, said council staff were “working through a large amount of material as quickly as possible”.
The detail
Nobody has officially named the attacker. ITPro reports that a relatively young extortion crew calling itself Wallstreet, active since around June and claiming 47 victims so far, added Bristol City Council to its leak site on 27 October. Threat intelligence firm Cypro notes that the listing carried no sample data, file trees or ransom note, and that the council has not linked Wallstreet to the attack. Until evidence emerges, it remains an unverified boast.
What is not in dispute is the sequence. An intrusion was detected, the service was isolated, an early assessment found no sign of exfiltration, and roughly six weeks later a large volume of files appeared online. Whether there was a ransom demand, and whether it was refused, has not been disclosed. The council says it is now auditing the published files to build a picture of who is affected, with headteachers passing guidance to families in the meantime.
Comparitech’s Rebecca Moody told ITPro she was concerned by the four-day gap between suspicious activity and shutdown, arguing that it gave intruders time to move and take data. That criticism should be weighed against what we do not know: how the attacker got in, when exfiltration actually took place, and what monitoring was in place.
Why it matters for UK organisations
This is a textbook example of shared-service concentration risk. A single council-run platform became the point of failure for dozens of schools at once, and each of those schools is likely to be a data controller in its own right. Under UK GDPR, a controller relying on a processor is still accountable for the personal data it hands over, and the ICO expects notification within 72 hours of becoming aware of a reportable breach. When a breach is first assessed as disruption without data loss, then later found to involve theft, organisations need to revisit that assessment promptly and update the regulator and affected people.
Children’s data raises the stakes further. School records can contain safeguarding notes, special educational needs information and family circumstances. Once published, that material cannot be recalled, and it gives fraudsters exactly the context they need to write convincing messages to parents about fees, trips or a child’s welfare.
Any multi-academy trust, housing association, NHS partnership or group of councils that consolidates IT into a shared platform is concentrating risk. Shared services can raise the security baseline, but only if they are monitored and segmented to a standard that reflects the combined value of everything they hold.
Expert view
In my experience, the most dangerous phrase in an early incident statement is “no evidence that data has been stolen”. It is often true at the time it is spoken, but it reflects the limits of the evidence rather than confirmation that nothing left the network. Many attackers now stage and exfiltrate data quietly before doing anything noisy, and if outbound traffic is not logged in detail, proving a negative is close to impossible. I would much rather see organisations say they are still determining whether data was taken.
When we test shared platforms in the public sector, the recurring weaknesses are rarely exotic. Flat networks between tenants, service accounts with far more access than they need, and file stores that accumulate years of records nobody has reviewed are the usual culprits. Administrative systems quietly become archives for sensitive documents. Data minimisation is a security control, not just a compliance checkbox.
I would also caution against reading too much into the Wallstreet listing. Leak-site entries without proof are cheap to post, and newer groups use high-profile names to build a reputation. Defenders should focus on the confirmed facts: data was taken and published, and the people named in it face a higher risk of phishing.
What to do now
- Assume targeted phishing is coming. Brief staff and parents that any message mentioning the incident, school fees or account verification should be checked through a known contact route. Forward suspect texts to 7726 and phishing emails to the national reporting address, report@phishing.gov.uk.
- Reset and harden accounts. Anyone whose staff details may be in the dump should change reused passwords and turn on multi-factor authentication. This maps directly to the Cyber Essentials user access control requirement.
- Review your own shared services. If you consume or provide a platform used by several organisations, confirm tenant segmentation, least-privilege service accounts and egress logging. Cyber Essentials firewall and secure configuration controls are the minimum; detailed outbound monitoring goes beyond them.
- Revisit early breach assessments. If an incident was logged as disruption only, set a review date to confirm or overturn that finding, and update ICO notifications accordingly.
- Purge what you do not need. Audit what sensitive records sit on administrative platforms and move or delete material that has no business being there.
- Agree contract terms with suppliers. Make sure agreements with shared-service providers spell out breach notification timelines, log retention and access for forensic work.
Bottom line
Bristol’s schools have gone from an outage to a data leak, and the families involved still do not know what has been exposed. The attribution remains unconfirmed, but the practical risk is clear: a large cache of school records is in criminal hands. Any organisation running or relying on shared IT should treat this as a prompt to check segmentation, logging and how much sensitive data it is storing.
