Legacy sign-on service comes back to bite school software provider Bromcom

Bromcom says intruders stole school SSO email addresses from a leftover legacy sign-on service.

UK education software provider Bromcom notified customers of a personal data breach in legacy single sign-on registration on its Communication Server. An unauthorized party retrieved email addresses, identity-provider names such as Microsoft or Google, registration and last sign-in dates, and internal reference numbers. The component did not hold passwords or authentication tokens, and Bromcom found no evidence its school management information system was compromised. The company identified the incident on September 6, withdrew the legacy function, and engaged forensic specialists. The superseded service had remained in production because an internal system still called it. Bromcom's software is used by more than 5,000 schools and 390 multi-academy trusts.