TWS Cyber Incident: How Soltech IT Is Helping Schools Rebuild Secure Networks and Protect Against Future Disruption

The cyber incident affecting Bristol schools and the Trading with Schools (TWS) network has highlighted just how dependent schools are on reliable internet connectivity and properly secured IT infrastructure.

What initially appeared to be a major broadband outage has developed into a much wider recovery exercise, with schools facing the challenge of restoring connectivity, checking devices, rebuilding networks and ensuring their systems are safe to use.

In its update on 15 October 2026, Bristol City Council confirmed that 84 of the 88 affected schools had regained limited internet connectivity. The council also confirmed a separate data breach involving Southville Primary School's management information system, where evidence showed that records had been exported. Investigations into the incidents are continuing.

For schools, the message is clear: restoring internet access is only the beginning.

Soltech IT is helping schools take a more comprehensive approach

At Soltech IT, we are working directly with schools to help them get back up and running, but importantly, we are also helping them put the foundations in place for a much more resilient IT environment.

Rather than simply providing an emergency internet connection, our approach involves a phased programme of work to restore, clean and ultimately rebuild the school's IT infrastructure.

Stage 1: Getting the school safely back online with 5G

Our first priority is getting schools operational again.

We are installing commercial-grade 5G broadband solutions, providing an independent internet connection away from the affected TWS infrastructure.

This allows schools to regain access to essential online services, subject to the appropriate security and filtering arrangements being in place.

Importantly, this connection won't simply be removed once the immediate problem has been resolved. It will become the school's secondary broadband connection, providing a backup service for the future.

This is particularly important because the Department for Education's Broadband Internet Core Standard states that schools should have a backup broadband connection to provide resilience and maintain continuity of service.

Stage 2: Creating a clean and usable network

Once connectivity is established, we move on to the immediate recovery of the school's working environment.

This involves identifying and preparing an initial group of approximately 10–15 essential devices, cleaning and checking them before connecting them to a newly configured, controlled network.

The objective is to give key members of staff access to working equipment and essential services while the wider recovery programme is planned and implemented.

We also establish appropriate network security, firewall and filtering arrangements, ensuring that getting back online does not mean compromising the school's safeguarding responsibilities.

Stage 3: Wiping and rebuilding the school's IT infrastructure

The next phase is a much more comprehensive exercise.

Working to an agreed recovery plan, we schedule the wiping and cleaning of the school's remaining devices, including desktops, laptops and servers, where required.

Following the necessary security checks and confirmation that any required data has been safely preserved, devices are rebuilt with clean operating system installations, updated software and appropriate security configurations.

This is not simply a case of reinstalling Windows. It is an opportunity to review how the school's entire IT environment is configured, remove outdated settings and establish a much more modern and manageable infrastructure.

The school's network infrastructure is also rebuilt and configured, providing a clean, properly structured environment for staff and pupils.

Stage 4: Installing a new filtered broadband solution

Alongside the infrastructure rebuild, we install a new primary filtered broadband service.

This provides the school with a modern broadband connection, supported by appropriate education-grade filtering and security controls.

Combined with the 5G connection installed during the initial recovery phase, the school will have two separate internet connections.

These can be configured to provide automatic failover, allowing the school to continue accessing the internet through its backup connection if the primary service becomes unavailable.

This is exactly the type of resilience the Department for Education is encouraging schools to implement.

A much stronger IT environment for the future

By the time the programme of work is completed, the school will have:

• Cleaned and rebuilt devices, with fresh operating system installations where required.
• A modern, properly configured network infrastructure.
• Updated security settings and appropriate access controls.
• A new filtered primary broadband connection.
• An independent 5G backup broadband connection.
• Appropriate filtering and monitoring across the network.
• A more manageable and supportable IT environment.
• An IT infrastructure designed around the Department for Education's digital and technology standards.

Soltech IT will then be supporting a modern, properly configured school network, rather than simply trying to maintain the systems that were in place before the incident.

Don't wait for another incident to expose the weaknesses in your network

Although the TWS situation has affected schools in Bristol, the lessons apply to every school and Multi-Academy Trust.

Schools need to consider what would happen if their broadband provider suffered a major outage, their network became compromised or they suddenly needed to rebuild their IT infrastructure.

Having a backup internet connection is no longer something that should be put off until the next budget year. It needs to form part of a school's wider IT resilience and disaster recovery planning.

The Department for Education's standards also cover cyber security, filtering and monitoring, network infrastructure and business continuity. These should all be considered together rather than as separate IT projects.

At Soltech IT, we believe this recovery programme provides affected schools with an opportunity to come out of an extremely difficult situation with a significantly better IT environment than they had before.

If your school is affected by the TWS incident, or you want to review your school's broadband resilience and cyber security arrangements, speak to Soltech IT.

We provide specialist IT support, broadband, networking and cyber security services to schools and Multi-Academy Trusts across the South West and beyond.



Soltech IT – helping schools stay connected, secure and ready for the future.