320,000 files leak from Bristol schools cyberattack

Files stolen in a September cyberattack on a schools IT platform run by Bristol City Council in England have been published online by the criminals behind it, the council said on 4 November. More than 320,000 files were published, taken from 39 of the schools that use the platform, the BBC reports. It says it cannot yet say which schools, pupils or staff are affected, and is auditing the files with outside security advisers, Avon and Somerset Police and the regional organised crime unit.

The 39 schools are those that rely most on the council's Trading with Schools platform for day-to-day work such as scheduling, lesson plans, staff records and payroll, the BBC reports. The platform can also hold sensitive files about children, including educational psychology records. Another 49 schools only buy internet access through it.

From "no evidence" to a leak

The council first noticed suspicious activity on the platform on 21 September but did not shut it down until 25 September, cutting internet access for dozens of schools, the BBC reported in October. On 5 October council leader Tony Dyer confirmed that malicious software had been found and said the council's analysis had "not identified any evidence that data has been stolen".

On 27 October a ransomware group calling itself Wallstreet listed Bristol City Council on its leak site, according to DailyDarkWeb, an account that tracks criminal leak sites. The council has not named the group or commented on the listing, and has not said whether the published files are the ones the group listed. Wallstreet has claimed more than 20 victims in recent weeks, mostly US healthcare providers, the tracker DarkWebSonar says.

A parent at one of the schools told the BBC she was shocked to hear about the stolen data only now.

What families and staff are told

Head teachers are passing council guidance to families. The council advises caution with unexpected emails, texts and calls even when they appear to come from a trusted organisation, turning on two-factor authentication, watching bank statements, and reporting suspicious emails to report@phishing.gov.uk and texts to 7726.