Thief snatches school snapper's SD cards in smash & grab
Stolen SD cards from a UK school photographer's van may hold Priory School pupils' photos, names, and classes.
Priory School in Lewes said Pret-a-Portrait reported that a vehicle was broken into overnight on 6-7 October 2026 and a camera bag containing SD cards was stolen. Those cards may have held photographs from the school's 1 October session and QR cards showing pupils' names and classes. The same equipment was used for three later jobs, and the company believes most or all of the pupil files were overwritten but cannot be sure. No evidence of improper access was found, other school-held personal data was untouched, and the company notified police and the ICO.
- A photographer's van was broken into overnight on 6-7 October 2026 and SD cards were stolen.
- Cards may contain Priory School pupils' photos, names, and class information.
- Later jobs may have overwritten most files, but the company cannot be certain.
- No evidence of improper access; school systems' sensitive records were not involved.
- Pret-a-Portrait notified police and the ICO and tightened card-handling procedures.
Full article542 words · extracted from theregister.com · click to collapse
REG AD
An old-fashioned smash-and-grab job on a photographer’s vehicle threatens the security of pupils’ data as a UK secondary school says it faces a potential data protection pickle.
Jon Curtis-Brignell, headteacher at Priory School in Lewes, said in an email this week that a company the school hired to take pupils’ annual school photos has alerted it to a data theft case after a vehicle was broken into.
“Pret-a-Portrait has informed us that, overnight between 6 and 7 October, one of its vehicles was broken into and a camera bag containing SD memory cards was stolen,” Curtis-Brignell wrote.
REG AD
“Some of these cards may have contained photographs taken at Priory School, together with images of the QR code cards used for school photographs, which show pupils’ names and class names.”
REG AD
The headteacher said that the same equipment used to take the photos at Priory School was also used for three additional photography jobs after Pret-a-Portrait visited the school on October 1.
Pret-a-Portrait, which has offices in the UK, Qatar, and the UAE, told the school that it believes “most, if not all” of the files containing pupils’ data will have been overwritten as a result, but it cannot be certain.
Curtis-Brignell said that the potentially affected information included photographs, pupils’ names, and their “class information associated with the photography process.”
Other types of data, such as addresses, contact details, financial information, medical information, and safeguarding records stored in the school’s own systems remain untouched.
Nick Kerr, owner of Pret-a-Portrait, told The Register that no physical, printed photos were stored in the vehicle at the time of the break-in, and that it was not possible to determine the potential scope of the data protection violation.
“As the email from Priory School explains, it is likely to be somewhere between a small subset of their pictures and none of them,” said Kerr.
On a positive note, he said that there is nothing to suggest the files have been improperly accessed.
“Our analysis reveals that no improper access to pictures from this job occurred in between the time of the theft and the pictures being taken offline.”
REG AD
Per the headteacher’s email, Pret-a-Portrait confirmed that it took a number of steps to mitigate the potential damage, including taking all school photos offline, changing the IDs used to access them, and changing its procedures so that all SD cards are wiped at the end of each commission.
The company also “reviewed and strengthened its procedures following the incident,” and reported the matter to both the police and the ICO.
“I appreciate that receiving an email of this nature may understandably cause concern,” Curtis-Brignell added. “We have worked closely with our Data Protection Officer and Pret-a-Portrait to understand what happened, establish the potential risk and ensure that appropriate action has been taken.
“We wanted to be open with families about what has happened, while also reassuring you that there is currently no evidence that the information has been accessed or misused and that a number of steps have now been taken to prevent access to the affected photographs and reduce the risk of a similar incident occurring again.” ®