Updated: 13.10.26 : We’ve updated this FAQ based on our ongoing investigation, in partnership with external specialists. We will continue to keep this page updated as our investigation progresses.
What happened?
An unauthorised third party temporarily accessed a limited part of our network, which we use to facilitate SSO registration. Our independent forensic investigation confirmed that the unauthorised third party ran a script which enabled them to retrieve certain SSO registration information relating to your school.
This is entirely separate from the MIS environment, which remained completely isolated and secure throughout. We immediately took steps to contain the unauthorised activity, secure our systems and launch an investigation with the support of external specialists to understand the precise nature and scope of the unauthorised activity.
What system or service was affected?
The incident involved an SSO registration component, which is separate from Microsoft and Google’s authentication services. It did not hold or return account passwords or authentication tokens or provide a mechanism to bypass the normal Microsoft/Google authentication process. We have removed the component from the Communications Server and have not identified any suspicious activity since the incident itself.
The MIS environment remained secure throughout.
Does this mean someone could have accessed Microsoft or Google accounts?
No. The incident did not provide access to Microsoft or Google’s authentication services.
. Account passwords and authentication tokens were not returned through the component.
Is your investigation ongoing?
Our investigation is complete. We will update you if our understanding changes.
Is personal data in scope?
We have reviewed the data involved to understand the nature of this information and contacted the schools and trusts in scope directly.
Importantly, the personal data involved is solely limited to email addresses associated with SSO registration. The incident did not involve the underlying personal data held within the MIS environment.
How do we know what personal data relating to our school is involved?
We have written to the schools and trusts involved directly and shared details about how to access the records involved.
We have uploaded a secure file(s) to your account in the support portal, with the details of the records involved. To access the file please go to ‘My Support’ in the top menu and select ‘Account Management’. You can find the files in the section titled ‘Incident Documents’
If you do not already have a Support Portal account please set one up. Please follow the instructions on our help centre, contact your support partner or email our Customer Care team if you require support on this.
Was registration information obtained by the unauthorised third party??
Our independent forensic investigation confirmed that an unauthorised third party ran a script which enabled certain registration information to be retained from the Communications Server.
We have undertaken a detailed review and verification of the relevant records and have contacted the affected schools and trusts directly with information about the findings relevant to them.
Were passwords, tokens or other authentication credentials exposed?
No. The SSO component did not hold account passwords, access tokens, refresh tokens, session tokens or similar user authentication credentials.
Was the school MIS or pupil MIS data accessed?
No. Our independent forensic investigation confirmed that the MIS remained secure throughout.
Could the information accessed be used to gain access to the MIS?
The registration information involved does not provide access to the MIS or bypass the normal authentication process.
Were parents involved?
No. The service relates to SSO registrations for staff and pupil accounts.
What is the potential risk to individuals?
Based on the advice of our external experts, our assessment is that the data involved poses a low risk to individuals. As always and in line with best practice, we encourage everyone to be vigilant for suspicious messages, calls or emails – particularly any asking them to click links, provide credentials, approve sign-in requests or reset passwords.
Was there any successful unauthorised access to Bromcom user accounts?
The investigation has not identified successful unauthorised sign-in to the MIS, MyChildAtSchool or a Bromcom user account, or successful account takeover arising from this incident.
What action should our school or users take?
There are no specific steps that schools need to apply as a result of this incident. We quickly restored access to SSO to minimise disruption. As always and in line with best practice, we encourage everyone to be vigilant for suspicious messages, calls or emails – particularly any asking them to click links, provide credentials, approve sign-in requests or reset passwords.
When did Bromcom become aware of the incident?
We first identified the incident on the 6th September, following reports of SSO access problems. We immediately took steps to contain the unauthorised activity, secure our systems and commence an internal investigation, supported by external forensic specialists, to establish the precise nature and scope of the activity.
As the investigation progressed and we established which customers were affected, we notified the relevant schools and trusts without undue delay. Given the complexity of the investigation and the need to review, match and verify the relevant registration records, this was an ongoing process, with further information provided as our understanding developed.
Why did it take this long for customers to be notified?
Providing you with full and complete information was our priority, so that you can make an informed decision. We need to complete our review thoroughly to ensure we share an accurate, verified list of the records involved.
What action has Bromcom taken to contain the incident and prevent recurrence?
We have:
- withdrawn the legacy SSO functionality from production;
- introduced additional school and account authorisation checks;
- restricted self-service removal to the signed-in user’s own registration; and
- improved operation-specific logging and security audit records.
Has Bromcom notified the ICO or any other relevant authorities?
We have not notified the ICO about this incident, as the data held on the communications server is data processed by Bromcom in our capacity as a data processer. We reviewed to determine the nature and scope of any data potentially involved, we are contacting the relevant data controllers so that they can assess the incident and determine the appropriate next steps for organisation.
Do we need to notify the ICO or affected individuals?
Each school or trust, as data controller, is responsible for assessing its own notification obligations under UK GDPR.
Based on the advice of our external experts, our assessment is that the data involved poses a low risk to individuals. We recognise that this is ultimately a decision for you to make and are committed to being as helpful as possible. We considered the following factors relevant:
- Limited nature of the affected personal data: the personal data involved is limited to email addresses and does not included the underlying personal data contained within the MIS environment, account passwords, authentication credentials or authentication tokens.
- MIS environment remained secure: we have identified no evidence of unauthorised access to the MIS environment or the underlying MIS data. The MIS environment remained secure throughout.
- Institutional email security: the majority of the email addresses involved use institutional email domains, protected by the technical and security measures you will likely have put in place.
We recognise that the decision regarding any regulatory or individual notifications ultimately rests with each data controller and remain available to assist with any questions.
We appreciate you might have questions about this news and you can contact our dedicated mailbox securityincident@bromcom.com where our team will respond to your questions.