Attackers have published thousands of files on the dark web following a hack affecting at least 39 schools in Bristol.
The schools used the Trading with Schools platform for tasks such as scheduling, lesson plans, recording staff details, and payroll.
On 29 September, the platform was hacked. Bristol City Council said an investigation into the incident “found that data had been taken” and subsequently published online.
The council is working with schools, security advisers, Avon and Somerset Police, and the Regional Organised Crime Unit to investigate. Right now, the council said it's not possible to confirm precisely which schools and individuals have been affected.
In the meantime, parents and carers are being advised to keep an eye out for phishing attempts.
"We recognise that news of a data theft linked to this cyber-attack will be concerning for parents, carers, school staff and the wider school community," said Vik Verma, director of education and skills at Bristol City Council.
"We understand that people will want answers about what information may have been affected and whether it relates to them or their family. Determining that remains a key focus of our investigation, and officers are working through a large volume of material as quickly as possible."
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
Wallstreet gang claims responsibility
The attack was claimed by the Wallstreet ransomware group, a relatively new gang that appears to have been operating since June, claiming 47 victims since then.
The group added Bristol City Council to its data leak site on 27 October - though with little information or evidence, and apparently no ransom demand.
“What concerns me most here isn’t the volume of information accessed, but whose information it is – this is far more serious than disruption to the school. Publishing the data shows cybercriminals’ complete lack of morality," commented Mat Pullen, director for education at Jamf.
"The system holds everything from lesson plans to educational psychology records, some of the most sensitive information a school holds about a child. It’s really important that the school quickly establishes what data has been stolen and whose it is, and provides the necessary support afterwards."
Rebecca Moody, head of data research at Comparitech, voiced concern that the council didn't shut down the Trading with Schools service until four days after it noticed the suspicious activity.
This, she said, gave the hackers plenty of time to infiltrate systems and steal data.
"We don't yet know exactly what data is involved, but students, staff, and parents of the schools should be on high alert for any suspicious activity and phishing messages. An increasing number of hackers are now directly contacting victims impacted by these attacks in a bid to exploit them as well," she said.
"The education sector has seen its highest level of ransomware attacks in recent years. With threat levels so high, failing to activate cybersecurity measures until four days after being alerted to suspicious activity isn't acceptable, in my opinion."