Legacy sign-on service comes back to bite school software provider Bromcom

UK edu­ca­tion soft­wa­re pro­vi­der Brom­com has no­ti­fied cus­to­mers of a per­so­nal data breach af­fec­ting its sin­gle sign-on (SSO) tech­no­logy. In a Sep­tem­ber 24 Edu­Geek post, an ac­count named Brom­com_Alas­tair said an unautho­ri­zed third party had ac­ces­sed and re­trie­ved email ad­dres­ses and li­mi­ted in­for­ma­tion as­so­cia­ted with af­fec­ted SSO re­gis­tra­tions. The in­ci­dent in­vol­ved le­gacy SSO re­gis­tra­tion fun­ctio­na­lity in Brom­com's Com­mu­ni­ca­tion Ser­ver en­vi­ron­ment. The com­pany con­fir­med in an FAQ it found no evi­den­ce that its school Ma­na­ge­ment In­for­ma­tion Sys­tem (MIS), used to ma­na­ge stu­dent data, at­ten­dan­ce, beha­viour, and ad­mi­nis­tra­tion, was com­pro­mi­sed. Brom­com said it was wor­king with ex­ter­nal fo­ren­sic spe­cia­lists to de­ter­mi­ne the na­tu­re and scope of the data in­vol­ved. The com­pany iden­ti­fied the in­ci­dent on Sep­tem­ber 6 after re­ports of SSO ac­cess pro­blems and has since with­drawn the le­gacy fun­ctio­na­lity from pro­duc­tion. The ser­vi­ce held email ad­dres­ses as­so­cia­ted with SSO re­gis­tra­tions, the pro­vi­der used, such as Mi­cro­soft or Goo­gle, re­gis­tra­tion and last sign-in dates where re­cor­ded, and in­ter­nal user and re­gis­tra­tion re­fe­ren­ce num­bers. Brom­com said the af­fec­ted com­po­nent did not hold ac­count pass­words or authen­ti­ca­tion to­kens. The le­gacy SSO re­gis­tra­tion fun­ctio­na­lity had re­mai­ned in pro­duc­tion after being su­per­se­ded be­cau­se "it was still being ca­lled by an in­ter­nal sys­tem," the sup­plier said. The in­ci­dent did not enable ac­cess to Mi­cro­soft or Goo­gle ac­counts, whose authen­ti­ca­tion ser­vi­ces are se­pa­ra­te from the af­fec­ted com­po­nent said Brom­com. The Re­gis­ter has asked Brom­com to com­ment further. Brom­com pro­vi­des in­for­ma­tion ma­na­ge­ment soft­wa­re used in schools and the wider edu­ca­tion sec­tor in the UK. It of­fers tools for bud­ge­ting, ti­me­ta­bling, HR, and bench­mar­king. Brom­com's soft­wa­re is used by more than 5,000 schools and 390 multi-aca­demy trusts (or­ga­ni­za­tions that run mul­ti­ple schools). Re­cent cus­to­mer wins in­clu­de New­port City Coun­cil, the Mi­nistry of De­fen­ce, War­wickshi­re County Coun­cil, and the Northern Ire­land Edu­ca­tion Autho­rity. ®…