Bristol City Council Took Four Days to Shut Down Schools System After Cyber Attack
Summary
Bristol City Council noticed suspicious activity on its schools-management platform on 21 September and shut it down on 25 September. The attack affected 87 schools; the council said it had found no evidence of data theft.
Key points
- The Trading with Schools service, used by Bristol schools for operations including budgets, staff details and payroll, was affected by malicious software.
- The council first noticed suspicious activity on 21 September and did not shut down the service until 25 September.
- The attack affected 87 schools, which were disconnected from the internet as the council responded.
- Council leader Tony Dyer said the council’s analysis had not identified evidence of data theft and that acting quickly helped limit the software’s spread.
- Schools faced disruption while being issued specialised devices to reconnect safely.
- Police said the South West Regional Economic and Cyber Crime unit was at an early stage of its investigation.
Article Details
- Victim Organization
- Bristol City Council
- Incident Type
- Cyber attack involving malicious software on the Trading with Schools service
- Incident Date
- 2026-09-21
- Disclosure Date
- 2026-10-05
- Operational Impact
- The attack affected 87 schools. The council disconnected affected schools from the internet, and schools were expected to experience disruption while being issued specialised devices to get back online safely.
- Ransom Or Extortion
- No ransom or extortion was reported. A cyber crime expert raised blackmail as a potential concern, but the article reports no evidence of data theft.
- Claim Status
- confirmed