What happened, who's affected, what we did and what you can do.
We understand that this situation may cause concern, particularly for the staff as well as parents and carers of the affected schools. We want to thank you for your continued support and understanding while the investigations continue.
What happened
The schools' IT network was the subject of a cyber-attack by organised criminals that was identified in September 2026.
Suspicious activity was identified on the schools' IT network and was investigated by our IT department. Once it became clear that this related to a cyber-attack, we took the decision to disconnect all 88 affected schools.
On Friday 30 October 2026, officers received information indicating that data was stolen during the attack and had been published online by the group responsible.
We informed the 39 schools we believe could be impacted that same day. Parents and carers were informed, via schools, on Tuesday 3 November 2026.
Investigations indicate that at this time approximately 320,000 files may have been taken from the network and made available online. This remains part of an ongoing investigation.
Throughout this period, we have been working with Avon and Somerset Police, the South West Regional Organised Crime Unit, the National Cyber Security Centre (NCSC) and the Information Commissioners Office, as well as other cyber security experts.
Who is responsible for the data theft
Investigations are ongoing and we cannot comment on attribution while those investigations continue.
What parents and carers should do
- Do not look for or try to access the published data.
- Be careful with unexpected emails, text messages and phone calls and do not click links or open attachments in unexpected messages.
- Never share passwords, bank details or personal information in response to an unexpected request.
- Change your passwords if you're concerned and use a different password for each account, turn on multi-factor authentication or passkeys where available.
- Check your online accounts and bank statements for anything unusual.
- Report suspicious emails to report@phishing.gov.uk and suspicious text messages to 7726.
If you have concerns, contact your school for advice and support.
We'll share updates as our investigation continues.
Affected schools
If your school is on the list, it does not mean its data has been stolen. We will not know exactly which schools or people are affected until our investigation is complete. We'll provide updates as we learn more.
Establishing which schools and individuals are affected remains one of the investigation team's highest priorities, which requires a detailed forensic review of a substantial volume of material.
If your school is not on the list, we believe it is unlikely to have been affected:
- Ashley Down Primary School
- Avonmouth C.E. V.C. Primary School
- Avonmouth Children's Centre
- Bannerman Rd Childrens Centre
- Bishop Road Primary School
- Briarwood Special School - Primary
- Bristol Hospital Education Service
- Broomhill Infant School
- Brunel Field Primary School
- Christ Church C.E. V.C. Primary School - Clifton
- Claremont School
- Every Family
- Filton Avenue Nursery School
- Hannah More Primary School
- Hartcliffe Nursery School
- Henleaze Infant School
- Henleaze Junior School
- Holy Cross Catholic Primary School
- Ilminster Avenue Specialist Nursery School
- Kingsweston Special School - Shirehampton Primary
- Knowle Park Primary
- Knowle West Nursery
- Our Lady Of The Rosary Catholic Primary School
- Redcliffe Maintained Nursery (and childrens centre)
- School Of Christ The King
- Shirehampton Primary School
- Southmead Children's Centre
- Southville Primary School
- Ss. Peter & Paul R.C. Primary School
- St Anne's Infant School
- St Bernadette Catholic Primary School
- St John's C.E. V.C. Primary School - Worrall Road
- St Joseph's Catholic Primary School
- Stoke Bishop C.E. V.C. Primary School
- Summerhill Infant School
- Two Mile Hill Primary School
- Westbury Park Primary School
- Whitehall Primary School
- Willow Park
Schools have stayed open throughout the incident and have continued to support children and young people with their education.
Where the files were shared
After a cyber-attack, criminals may share stolen files online without the permission of the people or organisations that own the information.
The stolen files have been published online and are currently being reviewed by specialist investigators from Avon and Somerset Police, the South West Regional Organised Crime Unit and the National Cyber Security Centre (NCSC).
We strongly advise schools, staff, parents and carers not to look for or try to access these files. Doing so could put them at risk and may affect the investigation.
Our cyber security specialists do not currently expect any more data to be published. However, we cannot guarantee this, and our investigation is continuing.
We have not paid and do not intend to pay a ransom.
Southville Primary School data breach
We're investigating the incident involving Southville Primary School's management information system separately.
While there are signs that the same cyber criminals may be responsible, this has not been confirmed and further investigations are continuing.
What we know about safeguarding risks
At this early stage we cannot confirm whether there are any increased risks.
Assessing and acting upon any safeguarding risks is our top priority and we're actively engaged with our safeguarding partners, such as the police and health services, to ensure that everyone's safety is our shared focus.
What you need to know
This is still an active criminal investigation.
We know that some data has been shared online, but we do not yet know exactly what information is involved or who may be affected.
The investigation has involved the Avon and Somerset Police, the South West Regional Organised Crime Unit, the National Cyber Security Centre (NCSC) and the Information Commissioners Office (ICO), as well as other cyber security experts., who continue to be fully engaged in the incident.
We have reported the data breach to the ICO, and schools have been advised to make precautionary reports and work with their own data protection services while the investigation continues.
While this is happening, we encourage everyone to be extra vigilant, stay alert and follow any cyber security advice shared by their school.
What we are doing
- Reviewing the published files to identify any schools or people who may be affected.
- Treating any potential safeguarding risks as a top priority.
- Supporting schools with their reporting responsibilities.
- Providing advice and support to staff, parents and carers.
- Restoring IT systems and devices as quickly and safely as possible.
- Providing secure replacement devices where needed.
- Working with specialist cyber security experts.
- Working closely with the police and other partner organisations.