Bromcom: legacy school sign-on service put registration data at risk
An incident involving legacy single sign-on registration functions put registration data at risk. Bromcom says there is no evidence its school MIS database was accessed.
What happened
Bromcom, a UK school software provider, says it identified an incident on September 6 involving legacy single sign-on (SSO) registration functions in its Communication Server — a superseded component that had stayed in production for an internal system. It has withdrawn that function. Its FAQ, updated September 30, says there is no evidence its school MIS database was accessed and no successful account takeover was identified; the investigation into scope is ongoing.
Who is affected
Limited to SSO registration data: email addresses, the sign-on provider used (such as Microsoft or Google), registration and last sign-in dates where held, and internal reference numbers. Bromcom says the component held no account passwords or authentication tokens, and whether data was copied out is still being determined.
How serious
The concrete risk is targeted phishing: a message that knows your email address and which provider you sign in with, asking for credentials, a sign-in approval or a password reset. The registration data held no account passwords or authentication tokens, and Bromcom says no successful account takeover was identified.
What to do now
Bromcom says no specific steps are required for schools, but urges everyone to stay vigilant for suspicious messages asking for credentials, sign-in approvals or password resets — verify those through your school or provider directly.