Bristol City Council admits 320,000 files from 'Trading with Schools' network stolen after four-day delay

While the council stated that 39 local schools "may be impacted,” the exact nature of the compromised data and the specific mechanism of the breach remain subject to ongoing forensic investigation by multiple agencies. The procedural response to the incident reveals significant delays in containment and notification. Suspicious activity was detected on the shared IT network on September 21, but the network was not taken offline until September 25.

Bristol City Council did not notify affected schools until October 30, the same day the council was informed that the data had appeared on the dark web. Parents and carers were subsequently informed on November 3. The decision to leave the network active for four days after the initial detection creates an unresolved question regarding the volume of data accessed.

It is currently unknown whether taking the network offline on September 21 would have prevented the loss of certain files. The council has stated that it has not paid, and does not intend to pay, a ransom to the perpetrators.