Legacy sign-on service comes back to bite school software provider Bromcom

Bromcom says intruders took email addresses from a legacy school SSO service, not its student MIS.

UK education software provider Bromcom notified customers that an unauthorized party accessed a legacy single sign-on registration function in its Communication Server. Retrieved data included email addresses, whether Microsoft or Google was the provider, registration and last sign-in dates, and internal reference numbers. Bromcom said the component held no passwords or tokens, did not enable access to Microsoft or Google accounts, and that its school management information system was not compromised. The company identified the incident on September 6, removed the legacy function, and is working with forensic specialists and authorities. Its software is used by more than 5,000 schools and 390 multi-academy trusts.