Bromcom notifies schools of data breach tied to legacy sign-on system

UK education software provider Bromcom has notified customers of a personal data breach after an unauthorized third party accessed email addresses and limited related information through a legacy single sign-on service that had been left running to support an internal system.

In a Sept. 24 post on the EduGeek forum, a Bromcom representative said the unauthorized party accessed and retrieved email addresses and limited information associated with affected single sign-on registrations. The incident involved legacy SSO registration functionality in Bromcom’s Communication Server environment, which remained in production after being superseded because an internal system was still calling it, the company said. Bromcom has since withdrawn the legacy functionality from production.

The company said the affected service held email addresses associated with SSO registrations, the identity provider used, such as Microsoft or Google, registration and last sign-in dates where recorded, and internal user and registration reference numbers. Bromcom said the affected component did not hold account passwords or authentication tokens and that the incident did not enable access to Microsoft or Google accounts, whose authentication services are separate.

Bromcom said that it found no evidence that its school Management Information System, which schools use to manage student data, attendance, behavior and administration, was compromised. The company said it identified the incident on Sept. 6 after reports of SSO access problems and is working with external forensic specialists to determine the nature and scope of the data involved.

A Bromcom spokesperson said the company recently identified, contained and began investigating an IT incident, that its investigation is ongoing, and that it has already taken steps to resolve any disruption. The spokesperson said Bromcom is working with the relevant schools and trusts, as well as appropriate authorities.

Bromcom supplies information management software used in schools and across the UK education sector, with tools for budgeting, timetabling, HR and benchmarking. Its software is used by more than 5,000 schools and 390 multi-academy trusts, organizations that run multiple schools. Recent customers include Newport City Council, the Ministry of Defense, Warwickshire County Council and the Northern Ireland Education Authority.

Please take 30 seconds to register

Already have an account? Sign in

"If we think of usability and security as mutually exclusive - we have failed" - Jerrod Chong, Yubico

#teissLondon2018: On the internet, nobody knows you are a fridge

1 in 6 gamers disable all AV in the pursuit of the highest possible speeds

10 malicious Python Libraries discovered on PyPI Repository

126,000 affected by cyberattack on New Zealand patient portal Manage My Health

"If we think of usability and security as mutually exclusive - we have failed" - Jerrod Chong, Yubico

#teissLondon2018: On the internet, nobody knows you are a fridge

1 in 6 gamers disable all AV in the pursuit of the highest possible speeds

10 malicious Python Libraries discovered on PyPI Repository

126,000 affected by cyberattack on New Zealand patient portal Manage My Health

19-year-old claims he hacked into over 25 Tesla cars in 13 countries

2020 cybersecurity trends and resolutions

2025 in review: why cyber-security became a boardroom crisis

Closing the exposure window — unifying continuous threat exposure management

Trusting your AI agents

The blind spots in your stack - why fragmented data security fails

Winston House, 3rd Floor, Units 306-309, 2-4 Dollis park, London, N3 1HF