Hackers publish 320,000 stolen school files on dark web as parents warned to stay 'vigilant'

Published: 06:38 EDT, 4 November 2026 | Updated: 06:41 EDT, 4 November 2026 Cyber criminals have stolen more than 320,000 files from Bristol schools and published them on the dark web.The files were taken from a server used by schools which holds sensitive information about children, including educational psychology reports.Bristol City Council said the personal data was stolen from 39 of the schools that use its Trading with Schools platform, which was hacked in September.However, it is still working with cyber specialists to identify the extent of the leak.Heads at the affected schools are now issuing guidance to families, including monitoring bank statements for unusual activity and reporting any suspicious-looking emails.Vik Verma, Director of Education and Skills at the council, said: 'We recognise that news of a data theft linked to this cyber-attack will be concerning for parents, carers, school staff and the wider school community.'We understand that people will want answers about what information may have been affected and whether it relates to them or their family. Determining that remains a key focus of our investigation, and officers are working through a large volume of material as quickly as possible.'He added that while the work continues, families should be cautious when receiving unexpected messages, emails and phone calls. Cyber criminals have stolen more than 320,000 files from Bristol schools and published them on the dark web (file picture)'We would encourage everyone to remain vigilant,' he added.'We continue to work closely with schools, cyber security specialists and law enforcement partners to understand the full impact of this incident.'We will keep schools, parents and carers updated as more information becomes available.'The council is working with Avon and Somerset Police and South West Regional Organised Crime Unit (SWROCU) as investigations continue.The hackers infiltrated Trading with Schools with malicious software on September 21.Council bosses only discovered the attack four days later and shut down the system.The platform is used by 88 schools under the council's umbrella, with 49 of those schools only purchasing the provision of internet services.The remaining 39, the schools whose data has been published online, rely more heavily on the system for day-to-day tasks such as scheduling, lesson plans, recording staff details and payroll information.The incident has caused widespread disruption for schools, with many unable to use their phones during the shutdown.Teachers have been working longer hours as they struggle to find ways to deliver their lessons.The dark web is a hidden part of the internet that is not indexed by common search engines and can only be accessed with specialist software.Dr John Curry, a reader in cyber security at Bath Spa University, said while the dark web has its legitimate uses, it is mostly used by people 'selling bad things'.He said that hacks such as this are usually carried out by crime syndicates who extract the data then pass it on to brokers who attempt to sell it.He told BBC News: 'They chop it up into chunks and decide who could use this - "if you buy this from us, you could use it to blackmail teachers and parents who have people at the school, you buy this set from us you might be able to use it for financial data".'The cyber security expert said once the data has been sold, it is often dumped online in its entirety to show other criminals what the hacking group is capable of in order to garner more work of this nature.The Daily Mail approached Trading with Schools for comment. The SWRCU was not able to comment on a live investigation.