320,000 school files published on dark web after attack on education platform
Data from dozens of schools has been accessed after an attack on the Trading with Schools platform
Attackers have published thousands of files on the dark web following a hack affecting at least 39 schools in Bristol.
The schools used the Trading with Schools platform for tasks such as scheduling, lesson plans, recording staff details, and payroll.
On 29 September, the platform was hacked. Bristol City Council said an investigation into the incident “found that data had been taken” and subsequently published online.
The council is working with schools, security advisers, Avon and Somerset Police, and the Regional Organised Crime Unit to investigate. Right now, the council said it's not possible to confirm precisely which schools and individuals have been affected.
In the meantime, parents and carers are being advised to keep an eye out for phishing attempts.
"We recognise that news of a data theft linked to this cyber-attack will be concerning for parents, carers, school staff and the wider school community," said Vik Verma, director of education and skills at Bristol City Council.
"We understand that people will want answers about what information may have been affected and whether it relates to them or their family. Determining that remains a key focus of our investigation, and officers are working through a large volume of material as quickly as possible."
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
Wallstreet gang claims responsibility
The attack was claimed by the Wallstreet ransomware group, a relatively new gang that appears to have been operating since June, claiming 47 victims since then.
The group added Bristol City Council to its data leak site on 27 October - though with little information or evidence, and apparently no ransom demand.
“What concerns me most here isn’t the volume of information accessed, but whose information it is – this is far more serious than disruption to the school. Publishing the data shows cybercriminals’ complete lack of morality," commented Mat Pullen, director for education at Jamf.
"The system holds everything from lesson plans to educational psychology records, some of the most sensitive information a school holds about a child. It’s really important that the school quickly establishes what data has been stolen and whose it is, and provides the necessary support afterwards."
Rebecca Moody, head of data research at Comparitech, voiced concern that the council didn't shut down the Trading with Schools service until four days after it noticed the suspicious activity.
This, she said, gave the hackers plenty of time to infiltrate systems and steal data.
"We don't yet know exactly what data is involved, but students, staff, and parents of the schools should be on high alert for any suspicious activity and phishing messages. An increasing number of hackers are now directly contacting victims impacted by these attacks in a bid to exploit them as well," she said.
"The education sector has seen its highest level of ransomware attacks in recent years. With threat levels so high, failing to activate cybersecurity measures until four days after being alerted to suspicious activity isn't acceptable, in my opinion."
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
‘Cyber criminal groups suffer from the same security weaknesses they routinely exploit’: ShinyHunters claims it hacked Clop ransomware rivalNews An attack on the cyber crime gang could prove dangerous for previous victims of data leaks, experts have warned
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments

