Nurseries among 320,000 files leaked on dark web

Council-run nurseries and special education settings may have been impacted by a hack that saw 320,000 stolen school files published on the dark web.

Bristol City Council has created a new web page identifying the 39 schools from which personal data could have been stolen during the hack in September.

Bristol Hospital Education Service, which supports children who have additional needs, and Filton Avenue Nursery School are among those listed.

It comes days after the authority notified staff and families that schools' data had been found online.

Vik Verma, the council's director of education, previously said that officers were "working through a large amount of material as quickly as possible" to determine the nature of the data published and would update families in due course.

The BBC understands only Bristol schools were impacted.

The list contains mostly council-run primary schools and nurseries, with some specialist education settings also mentioned. However, not all schools on the list have had data stolen.

Council leaders said they "will not know exactly which schools or people are affected until our investigation is complete", adding that it will "provide updates as we learn more".

The authority said that it was still working to understand which schools and individuals were affected, adding that it "requires a detailed forensic review of a substantial volume of material".

The council's trading with schools platform was infiltrated by malicious software on 21 September, with the council shutting the system down four days later.

Of the 88 council-run schools that use the platform, 49 use it solely to purchase internet services, while the remaining 39 which rely on it more heavily for their operations had their data stolen.

Many of the affected schools have been left in disarray following the hack, with much of their lesson planning and scheduling on the server.

The authority notified head teachers of the breach on Tuesday evening (3 November), with parents and staff updated with advice the following morning.

• Being cautious of unexpected emails, text messages and phone calls, even if they appear to come from a trusted organisation
• Avoiding clicking on links or opening attachments in unexpected messages
• Being wary of requests to reset passwords, verify account details or provide personal or financial information
• Using strong and unique passwords on important online accounts and enabling two-factor authentication where available
• Monitoring online accounts and bank statements for any unusual activity
• Reporting suspicious emails to report@phishing.gov.uk and suspicious text messages to 7726

Follow BBC Bristol on Facebook, X and Instagram. Send your story ideas to us on email or via WhatsApp on 0800 313 4630.