If it's happening now
Follow your cyber response plan. If you don't have one, use the DfE's live attack guidance. Call your managed service provider or trust IT team immediately and do what they say. They may ask you to turn devices off or take them off the network, so please don't improvise. Tell your leadership team and safeguarding lead, and your local authority if that applies to you.
If you're in the DfE's Risk Protection Arrangement with cyber cover, it gives you expert support 24 hours a day. Their number should be on the printed copy of your plan. If you have commercial cover, ring your insurer before you bring in anyone else, as your policy may say who you can use.
Log what happened, what you did and when. Keep anything that might help the investigation, and don't delete files, emails or ransom notes.
If personal data may have been lost, stolen or accessed, your DPO needs to assess the risk to the people involved straight away. If harm to them is likely, you must tell the ICO as soon as possible, and where feasible within 72 hours. If the risk to them is high, you must also tell them without undue delay. You can report what you know now and add detail later. If you're unsure, the ICO helpline is 0303 123 1113.
The DfE asks you to report to your RPA or insurer, to Report Fraud on 0300 123 2040, and to its sector cyber team at [email protected]. A report to the NCSC may also be needed if it means long-term closure, more than one school closing, or serious financial damage. Use a device and account that aren't on the affected network, and assume email and shared drives may be watched.
The Academy Trust Handbook is explicit: trusts must not pay ransom or extortion demands. The DfE backs the National Crime Agency in not encouraging payment, and warns that it's no guarantee of restoring access and is likely to bring repeat incidents. Whatever type of school you are, talk to your RPA or insurer and the police before you reply.
Staff and parents will hear about it anyway, and families want regular updates, even small ones. Agree the wording with your IT support, DPO and RPA or insurer, and use the DfE's communication templates. Say what you know, what you don't and when you'll next update them. Don't speculate about the cause, the attacker or what data is involved.
We're not an NCSC-assured incident response company and we work UK office hours, so your IT support and your RPA or insurer are the right first calls. This is general guidance drawn from the DfE and ICO, not legal advice.
The news
On 21 September 2026, malicious software got into Trading with Schools, a platform Bristol City Council runs for local schools. The council found it four days later and shut the system down. On 4 November, the BBC reported that more than 320,000 stolen files had been found on the dark web, taken from 39 of the 88 schools that use it.
Those 39 relied on the platform for everyday work such as scheduling, lesson plans, staff details and payroll, and it can also hold sensitive information about children, including educational psychology files. The council says it can't yet confirm what was published and is working through the material. The South West Regional Organised Crime Unit is investigating.
More: Bristol24/7. Our summary of published reporting; we have no inside knowledge of the investigation.
39 of 88 schools on one platform
Each dot is one school, placed for illustration. Amber marks the 39 that relied on the platform for everyday work, whose files were stolen. The other 49 bought only internet services through it.
21 September
Malicious software gets into the Trading with Schools platform.
25 September
The council becomes aware of the attack, four days on, and shuts the system down.
The weeks after
Many schools can't use their phones, and teachers work longer hours to keep lessons going.
4 November
The BBC reports more than 320,000 stolen files found on the dark web, taken from 39 schools.
It isn't just Bristol
September to November 2026
Malicious software got into the council-run platform on 21 September. The council found it four days later and shut the system down. By 4 November, more than 320,000 stolen files from 39 schools had been found on the dark web, and many schools had spent weeks without working phones.
SourceApril to June 2026
An attack on the network that provides IT to Northern Ireland's schools locked pupils out of their accounts in the run-up to exams. In June, further forensic work led the Education Authority to warn parents at 23 schools that personal data may have been accessed, 16 of them newly told.
SourceJanuary 2026
An attack on 3 January took out phones, email and the school's management system, and with them the electronic gates and fire alarms. The school closed on safety grounds and did not reopen to all pupils on a full timetable until 19 January, after effectively rebuilding its IT from scratch.
SourceCommon questions
If a personal data breach is likely to put people at risk, yes: as soon as possible and, where feasible, within 72 hours of becoming aware of it. If the risk to them is high, you must also tell them without undue delay. The DfE's guidance gives a ransomware attack on a school's records as an example of a breach that should be reported. Your data protection officer should lead on this, and the ICO helpline is 0303 123 1113.
Academy trusts must not, under the Academy Trust Handbook. Whatever kind of school you are, speak to your RPA or insurer and the police first. The DfE's position is that paying has no guarantee of restoring access or services and is likely to result in repeat incidents.
It can. The DfE's Risk Protection Arrangement offers cyber cover to public sector schools that meet its conditions, which the DfE says include offline backups, NCSC training, Police CyberAlarm registration and a cyber response plan. Check you meet them now, because that's far easier to fix before a claim than after one.
Follow the guidance from your school and the council, who are still working out what was published. Be careful with unexpected emails, texts and calls even if they seem to come from someone you trust, use different passwords with two-factor sign-in on important accounts, and watch your bank statements. Forward suspicious emails to [email protected] and text messages to 7726. Please don't go looking for the files yourself.
Through your investigators, your RPA or insurer's specialists and the police. Stolen files can hold other children's sensitive information, so this isn't something for staff or an ordinary IT supplier to go searching for. We won't look through leaked data ourselves either.
Sources
If it hasn't happened to you
In about a week, our School Cyber Check shows you where you stand against the DfE standards and the RPA conditions, which suppliers hold your data, and what to do first, in a report your governors can read. It works alongside your IT provider, and we don't ask for pupil records.