When a business hands its data to a shared platform, it also hands over part of its security.
That is the lesson of a breach reported on 4 November, in which more than 320,000 files taken from a council-run school administration platform have been published on the dark web.
If you rely on a supplier, a portal or an IT provider to run payroll, staff records or scheduling, this one is worth understanding.
What happened
According to LBC and other reports, Bristol City Council's Trading with Schools platform was compromised in September. Malicious software was used against it on 21 September, and the system was shut down on 25 September. The platform handles administrative work for schools, including lesson scheduling, staff management and payroll. More than 320,000 files have since been found on the dark web.
Of the 88 schools that use the platform, reports say 39 have been identified as having affected data. The council has said it is working through a large amount of material to establish what was published, and it has not yet confirmed which individuals are affected.
The platform can hold sensitive pupil information, including educational psychology records, but the council has not confirmed whether such files are among those published. We don't yet know who carried out the attack or whether a ransom was demanded.
Avon and Somerset Police, the Regional Organised Crime Unit and cyber security specialists are involved. Headteachers have been told, and parents and carers have been asked to stay alert for unexpected messages, emails and calls.
Why a shared platform changes the risk
One system, many organisations. That is the efficient part of a shared platform and also its weak spot.
A single break-in can expose the records of dozens of customers at once, and none of those customers may have been able to see the weakness beforehand. The schools here did nothing unusual. They used a platform their council provided.
There is also a delay. The attack happened in September and the published files surfaced in November. For the people whose details were in them, that gap is the problem: criminals can use staff names, contact details and employment information long before anyone has finished the clean-up.
What this means for UK small businesses
You probably don't run a school, but you almost certainly use outside platforms for payroll, HR, bookings, accounting or file storage.
Under UK data protection law you remain responsible for personal data you hand to a supplier, so "it was their system" is not a complete answer if staff or customer records leak. If you are an MSP, your clients will ask you the same question.
The good news is that the response is practical rather than technical. Knowing where your data lives, and what your suppliers promise to do with it, takes an afternoon.
What to do this week
Make a list of who holds your data. Write down every platform that stores staff, customer or supplier information, and what sort of information it is. Most firms find two or three they had forgotten.
Ask each supplier three questions. How do you protect our data, how quickly would you tell us about a breach, and what do you do with our data if we leave? Keep the answers.
Share less. Delete old records you no longer need, and don't upload sensitive files to a platform just because it is convenient. Data that isn't there can't be published.
Brief your team on follow-up scams. After a leak, expect convincing emails, calls and texts that use real details. Follow the council's advice: be wary of unexpected messages, check by calling a number you already have, and never act on a request for passwords or payment details.
Know your reporting duty. If personal data is exposed, you may need to tell the ICO within 72 hours of becoming aware. Write down who decides and who makes the call before you need to.
Sophia Says
I think the honest takeaway is that you can't outsource the responsibility, only the work. Schools trusted a platform that was meant to make life simpler, and now head teachers are the ones answering parents. Every small business has its own version of that platform, so it's worth knowing yours.
HackRisk can't see inside a supplier's systems. What we can do is look at your business from the outside, check whether your staff logins have turned up in leaked data, and help you see how your suppliers look to an attacker.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Supplier risk: the Supply Chain Risk service helps you see how the suppliers you rely on look from the outside.
Leaked logins: the Dark Web Scan checks whether staff email addresses and passwords for your domain have appeared in breach data.
Follow-up scams: our explainer on security awareness training shows how to prepare your team for the scam messages that follow a leak.
Get your free HackRisk report
See your business the way an attacker does, in plain English, with clear next steps. Get your free HackRisk report.
