🚨Bromcom SSO Breach Exposes Data of 5,000 UK Schools
UK Education Software Provider Faces SSO Data Breach
TL;DR
Bromcom's single sign-on technology breach exposed email addresses and limited info of 5,000 UK schools. No passwords or authentication tokens compromised.
Bromcom, a UK education software provider, suffered a data breach affecting its single sign-on (SSO) technology. The breach exposed email addresses and limited information of 5,000 UK schools, but no account passwords or authentication tokens were compromised. The incident highlights the importance of regularly reviewing and decommissioning legacy systems. Bromcom's investigation is ongoing, and the company has notified affected schools and trusts. The breach involved the legacy SSO registration functionality in Bromcom's Communication Server environment, which remained in production after being superseded due to an internal system dependency. This incident underscores the need for continuous monitoring and maintenance of legacy systems to prevent data exposure.
Key Points
Bromcom's SSO breach affected 5,000 UK schools and 390 multi-academy trusts, impacting email addresses and limited SSO registration info.
The breach was identified on September 6, and the legacy SSO functionality was withdrawn from production immediately.
Bromcom's school Management Information System (MIS) was not compromised, limiting the scope of the breach.
The incident involved legacy SSO registration functionality still being called by an internal system, despite being superseded.
Bromcom is liaising with affected schools and trusts, as well as relevant authorities, to address the breach.
Why It Matters
If you're using Bromcom's software in UK schools, this breach affects your data security. It highlights the need to review legacy systems and SSO implementations regularly.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.