320,000 school files published on dark web after attack on education platform

Data from dozens of schools has been accessed after an attack on the Trading with Schools platform

Ransomware concept image showing a yellow-colored alert symbol pictured against a jet black background.
(Image credit: Getty Images)

Attackers have published thousands of files on the dark web following a hack affecting at least 39 schools in Bristol.

The schools used the Trading with Schools platform for tasks such as scheduling, lesson plans, recording staff details, and payroll.

On 29 September, the platform was hacked. Bristol City Council said an investigation into the incident “found that data had been taken” and subsequently published online.

The council is working with schools, security advisers, Avon and Somerset Police, and the Regional Organised Crime Unit to investigate. Right now, the council said it's not possible to confirm precisely which schools and individuals have been affected.

Latest Videos FromIT Pro

In the meantime, parents and carers are being advised to keep an eye out for phishing attempts.

"We recognise that news of a data theft linked to this cyber-attack will be concerning for parents, carers, school staff and the wider school community," said Vik Verma, director of education and skills at Bristol City Council.

"We understand that people will want answers about what information may have been affected and whether it relates to them or their family. Determining that remains a key focus of our investigation, and officers are working through a large volume of material as quickly as possible."

Wallstreet gang claims responsibility

The attack was claimed by the Wallstreet ransomware group, a relatively new gang that appears to have been operating since June, claiming 47 victims since then.

The group added Bristol City Council to its data leak site on 27 October - though with little information or evidence, and apparently no ransom demand.

“What concerns me most here isn’t the volume of information accessed, but whose information it is – this is far more serious than disruption to the school. Publishing the data shows cybercriminals’ complete lack of morality," commented Mat Pullen, director for education at Jamf.

"The system holds everything from lesson plans to educational psychology records, some of the most sensitive information a school holds about a child. It’s really important that the school quickly establishes what data has been stolen and whose it is, and provides the necessary support afterwards."

Rebecca Moody, head of data research at Comparitech, voiced concern that the council didn't shut down the Trading with Schools service until four days after it noticed the suspicious activity.

This, she said, gave the hackers plenty of time to infiltrate systems and steal data.

"We don't yet know exactly what data is involved, but students, staff, and parents of the schools should be on high alert for any suspicious activity and phishing messages. An increasing number of hackers are now directly contacting victims impacted by these attacks in a bid to exploit them as well," she said.

"The education sector has seen its highest level of ransomware attacks in recent years. With threat levels so high, failing to activate cybersecurity measures until four days after being alerted to suspicious activity isn't acceptable, in my opinion."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.

Emma Woollacott

Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.