The Bristol schools data leak: what every school should know

Cyber security for schools and academy trusts

Could it happen here? After Bristol, it's a fair question for any school. We'll help you answer it honestly, in writing, show you what to fix first and make sure your team knows what to do if the day ever comes.

  • Fixed prices from £950
  • Works alongside your IT provider
  • We don't ask for pupil records
  • Written for governors

Why now

Your school can be hit through something you rely on

Look at what happened in Bristol. Malicious software got into a platform the council ran for its schools, and files from 39 schools ended up on the dark web. Those schools had trusted a supplier, as every school has to. Weeks later, many still couldn't use their phones.

You can't remove that risk altogether, and anyone who promises you can is selling something. What you can do is know exactly who holds your data, make sure the obvious doors are locked, and have a plan your leadership team has actually practised. That's what we do, at a fixed price you can take straight to your business manager.

73%

of secondary schools identified a breach or attack, up from 60%. Phishing was the main threat, and 1 in 5 of those schools reported harm to their systems

49%

of primary schools identified a breach or attack in the same survey

320,000+

files from a Bristol schools platform found published online in November 2026

72 hours

to tell the ICO about a reportable personal data breach, from the moment you know

Start here

Where are you today?

“We think we're fine, but who really knows?”

Start with the School Cyber Check. In about a week you'll know where you stand and what to do first.

See the check

“The board wants this sorted across the trust”

One review of what the trust runs centrally, sampled across your schools, with a single report for your audit and risk committee.

See the trust review

“Something's wrong right now”

Follow your response plan and call your IT support and your RPA or insurer first. Our guide sets out who to call and in what order.

What to do now

What we do

Clear jobs, clear prices

You'll know the cost before anyone has to take it to the governors, and you'll end up with something you can show them.

School Cyber Check

From £950primary or small school; £1,350 secondary; £1,750 large or multi-site

Written report within 5 working days of our session

A straight answer to “would we be all right?”. We go through your setup against the DfE cyber security standards with you and your IT provider, and tell you what to fix first. It's a review based on what you show us, not a certificate or proof of RPA compliance.

  • Your position against each DfE cyber security standard
  • The RPA cyber cover conditions the DfE lists, gone through one by one
  • MFA, admin accounts, backups and restore tests reviewed
  • Which suppliers hold your data, and who would tell you if they were hit
  • Your website and public-facing services, looked at from outside only with your written permission
  • A plain-English report your governors can read, with fixes in priority order

Cyber Response Plan & Exercise

From £1,100primary or small school; £1,450 secondary; £1,850 large or multi-site

Plan and exercise within 10 working days

A plan your team has actually practised. We build it from the DfE template around your people, then run a real scenario with your leadership team so nobody meets it for the first time on the day.

  • DfE template tailored to your school, roles and deputies
  • Who calls whom, in what order, including your RPA or insurer
  • Draft messages for staff and parents, for your DPO to approve
  • A printed copy, because the shared drive may be gone
  • A 90-minute live exercise with your leadership team, online or in person
  • A short note of what the exercise showed and what to change

School Ready: Check + Plan

From £1,795primary or small school; £2,450 secondary; £3,150 large or multi-site

All done within 15 working days

Both of the above together, for less than buying them separately. It's where we'd start: know where you stand, then be ready if it happens anyway.

  • Everything in the School Cyber Check
  • Everything in the Cyber Response Plan & Exercise
  • The exercise built around the gaps the check finds
  • One short summary for your governors or trustees

Trust Cyber Review

From £3,950up to 5 schools, then £395 a school

Quoted in writing, usually within 4 weeks

One attack can reach every school that shares your systems. We look at what the trust runs centrally and sample your schools, so your board sees one clear picture and one priority list.

  • Central Microsoft 365 or Google tenant, admin accounts and MFA
  • Backups and restore tests across the trust
  • Shared suppliers, and what happens if one of them goes down
  • One response plan for the trust, with a page for each school
  • A report for your audit and risk committee

Termly Review

From £395a term; £495 secondary; £595 large or multi-site

One session and a written update each term

The DfE asks you to assess cyber risk every year and revisit it every term. We keep that on track, so it doesn't fall to the business manager in the last week of term.

  • Your risk assessment revisited, as the DfE asks
  • Progress on your fix list, checked with your IT provider
  • New threats and supplier changes that affect you
  • An update ready for your next governors' meeting

Everything runs online as standard, so there's normally no travel to pay. Prefer us in the room? We add one fixed fee per trip: £195 in Greater London, £395 up to about two hours away, and £695 further afield, including any overnight stay. We quote for Scotland, Northern Ireland and the islands.

Prices exclude VAT. Every price is agreed in writing before any work starts, and trust reviews are quoted to your size. A large school has over 1,500 pupils.

How it works

From first message to a report you can use

  1. 01

    Tell us about your school

    How many sites, who runs your IT, and whether you're in the RPA. A short message is plenty.

  2. 02

    Fixed price, in writing

    You'll get the scope, price and dates to take to your head or business manager.

  3. 03

    A session with your IT people

    A couple of hours, online as standard. They open the settings and we go through them together. We don't ask for pupil records.

  4. 04

    A report in plain English

    What's good, what's missing and what to fix first. We'll talk it through with you and your IT provider.

Your school website

Is your website running on old software?

Plenty of websites run on PHP, including anything on WordPress, and two critical PHP flaws were fixed on 21 October. It takes a minute to see what your site tells the world about itself. Our free check sends one ordinary page request, only when you ask it to, and doesn't test for the flaws.

Straight answers

Questions you may have

We already have an IT provider. Do we need you as well?

Your IT provider keeps the school running, and that's a full-time job. We don't replace them or try to win their contract. We give you an independent second pair of eyes against the DfE standards, work through the findings with them, and hand them a clear list. A good provider should welcome that, because it puts their recommendations in front of the people who hold the budget.

Do you need to see pupil records?

No, and we won't ask to. We look at how systems are set up, not at what's in them. You or your IT provider share the screen and open the settings while we go through them together. Admin screens can show names such as user accounts, so we agree confidentiality and data-handling terms in writing before we start.

Is this a cyber security audit or a penetration test?

Neither, and we'll tell you if you need one. The School Cyber Check is a review based on what you and your IT provider show us: your setup, your plans and your suppliers. It isn't a certificate, and it isn't proof of RPA or insurance compliance. If your risk or your insurer calls for a formal test, we'll say so and point you to a CREST-accredited tester.

Are you an incident response company? What happens if we're attacked?

We're not an NCSC-assured incident response provider, and we work UK office hours, so please don't rely on us as your emergency line. If you're in the RPA, it gives you expert support 24 hours a day. Our job is to make sure you know that number, have it on paper, and have practised using it. Afterwards, we can help you review what happened and plan the fixes with your IT provider.

We're an independent school. Does this still apply?

Yes. The DfE standards make a sensible yardstick for any school, and many insurers ask similar questions. The RPA is for public sector schools, so we'd check your commercial cyber policy's conditions in place of the RPA's.

We're in Wales, Scotland or Northern Ireland. Can you help?

Yes, though the DfE standards are written for England and your own education department and local arrangements come first. We'd use the DfE standards as the yardstick and work within whatever already applies to you.

Can we do this ourselves for free?

You can make a real start. The DfE's Cyber Security Hub has a response plan template, and its plan technology for your school service lets you self-assess, and we'll happily point you to both. What's harder to find is the time, and someone who can read a Microsoft 365 admin screen and tell you what it means. That's what you'd be paying us for.

How do we pay? Do you work with our procurement rules?

Tell us what your finance policy needs. You'll get a fixed written quote you can take to your business manager or head before anything is booked, and we'd expect to invoice the school or trust directly.

Based on:DfE: Cyber security core standard DfE Cyber Security Hub: Risk Protection Arrangement DSIT: Cyber security breaches survey 2025/2026, education institutions findings

The easiest time to do this is before anyone needs it

Tell us a little about your school and who runs your IT. We'll reply within one working day with what we'd suggest, and what it would cost.