More than 320,000 files stolen in a cyberattack on a council's schools server have been found on the dark web, according to BBC News. The data was stolen from 39 of the schools that use Bristol City Council's Trading with Schools platform, which was infiltrated in September.

Headteachers have been informed of the development and are issuing guidance to families at the affected schools. Vik Verma, director of education at the authority, stated that officers are working to determine the nature of the published data and will update families accordingly.

The Trading with Schools platform was breached by malicious software on September 21, with the authority alerted four days later and subsequently shutting down the system. The platform is used by 88 schools, but 39 of them rely on it more heavily for tasks including scheduling, lesson plans, staff details, and payroll information. The system can also store sensitive information about children, such as educational psychology files.

Since the system shutdown on September 25, many schools have experienced disruptions, including unusable phone lines and increased workloads for teachers. The dark web, a part of the internet not indexed by standard search engines and accessible only with specialized software, is where the stolen files have surfaced.

Dr. John Curry, a reader in cyber security at Bath Spa University, explained that such hacks are typically carried out by crime syndicates who sell the data to brokers for financial gain. These brokers may use the data for blackmail or to exploit financial information. He added that the full datasets are often dumped online to showcase the hacking group's capabilities.

Verma acknowledged the distress this could cause and emphasized that the authority's investigation is focused on identifying what information may have been affected. The council is providing schools and families with advice on online safety, urging them to be vigilant of unexpected messages, emails, or phone calls and to follow guidance shared through schools.

The South West Regional Organised Crime Unit is investigating the cyberattack.