Hackers publish 320,000 school files on dark web

More than 320,000 files stolen in a cyber attack on a council's schools server have been found on the dark web.

Bristol City Council said the data was stolen from 39 of the schools that use its Trading with Schools platform, which was hacked in September.

Head teachers have been informed about the development and are issuing guidance to families at the affected schools.

Director of education at the authority Vik Verma said its officers were "working through a large amount of material as quickly as possible" to determine the nature of the data published and would update families in due course.

Trading with Schools was infiltrated by malicious software on 21 September, with the authority becoming aware of the attack four days later and shutting down the system.

The platform is used by 88 schools under the council's umbrella, with 49 of those schools only purchasing the provision of internet services.

The remaining 39, the schools whose data has been published online, rely more heavily on the system for day-to-day tasks such as scheduling, lesson plans, recording staff details and payroll information.

The platform can also house sensitive information about children, including educational psychology files.

Since the system was shut down on 25 September, many schools have been unable to use their phones and teachers have been faced with longer working hours as they struggle to find ways to deliver their lessons.

The dark web is a hidden part of the internet that is not indexed by common search engines and can only be accessed with specialist software.

Dr John Curry, a reader in cyber security at Bath Spa University, said while the dark web has its legitimate uses, it is mostly used by people "selling bad things".

He explained that hacks such as this are usually carried out by crime syndicates who extract the data then pass it on to brokers who attempt to sell it.

"They chop it up into chunks and decide who could use this - 'if you buy this from us, you could use it to blackmail teachers and parents who have people at the school, you buy this set from us you might be able to use it for financial data'," he said.

The cyber security expert said once the data has been sold, it is often dumped online in its entirety to show other criminals what the hacking group is capable of in order to garner more work of this nature.

Verma acknowledged the distress this could cause the school community in the city.

He explained the key focus of the authority's investigation was to determine "what information may have been affected and whether it relates to them or their family".

Verma said they were ensuring schools, families and staff had "clear advice on the practical steps they can take to protect themselves online".

"We would encourage everyone to remain vigilant, be cautious of unexpected messages, emails or phone calls, and follow the guidance being shared through schools."

The South West Regional Organised Crime Unit is investigating the cyber attack and has been approached for an update.

Advice to families and school staff includes:

• Being cautious of unexpected emails, text messages and phone calls, even if they appear to come from a trusted organisation
• Avoiding clicking on links or opening attachments in unexpected messages
• Being wary of requests to reset passwords, verify account details or provide personal or financial information
• Using strong and unique passwords on important online accounts and enabling two-factor authentication where available
• Monitoring online accounts and bank statements for any unusual activity
• Reporting suspicious emails to report@phishing.gov.uk and suspicious text messages to 7726

Follow BBC Bristol on Facebook, X and Instagram. Send your story ideas to us on email or via WhatsApp on 0800 313 4630.