Bristol Labour calls-in school cyber security incident for scrutiny
It happened in September
Last updated 8th Oct 2026
Labour councillors in Bristol have called-in the recent schools cyber security incident, for scrutiny.
On 21 September 2026, Bristol City Council first noticed suspicious activity, later identified as a cyber-attack, on the Trading with Schools service - a platform run by Bristol City Council, used by local schools, to manage day-to-day operations. Councillors claim they have been provided with limited information on the incident and no updates concerning how the Council plans to learn from this and ensure it does not happen again.
Labour Councillors have called an Extraordinary Meeting, to allow cross-party councillors to scrutinise the incident. In the near future, a meeting of the Children and Young People Policy Committee will be convened, so councillors can scrutinise matters including, but not limited to:
• The nature of the cyber incident, the timeline relating to the incident and the steps that have been taken since
• What the intent behind the cyber incident was – for example, whether it was a malicious attack, either designed to disrupt school servers, or take sensitive data
• What mitigations have been put in place in response to the incident
• The disruption that schools have faced due to this
• Whether any data has potentially been leaked
• The lessons learnt from this incident
• Lessons learnt from other incidents of similar nature in the UK
• Measures the Council has put in place to stop similar incident happening in future
• Any other relevant matters raised by members of the Children and Young People Committee.
Labour Vice Chair of the Children and Young People Committee, Councillor Katja Hornchen, said: “The cyber attack on Bristol’s schools is a deeply troubling incident, that cannot be allowed to happen again. Investigations into it are at an early stage, but the Council needs to be on the front-foot, to learn lessons from it and better manage these types of threats in future.
“We have not received much information, nor sufficient reassurances about the scale of the attack and how it was managed. Four days passed between the Council noticing ‘suspicious activity’ and shutting it down. In a world where it only takes seconds to transfer large amounts of data, this is very worrying.
“The Council must be more transparent with elected councillors. Scrutiny is a crucial component of good governance. By allowing councillors to scrutinise this incident, the administration can learn from it and more effectively manage attacks like this in future.”