UK school software provider Bromcom says an unauthorized party accessed a legacy single sign-on registration component and retrieved email addresses and limited related data. The affected system was older SSO registration functionality in Bromcom's Communication Server environment that remained live because an internal system still called it; Bromcom says its core school Management Information System was not compromised, and the exposed data included email addresses, identity provider used such as Microsoft or Google, sign-up and last sign-in dates where recorded, and internal reference numbers, but not passwords or authentication tokens.
Why it matters: Schools and education organizations using Bromcom should treat this as a real exposure of user contact and account-metadata that could enable phishing or impersonation. Affected customers should watch for targeted emails, review Bromcom guidance, and confirm the legacy SSO path has been removed and related accounts monitored.
2026.10.06
98% relevant
This article is a direct report on the same Bromcom breach, adding timing details on discovery, confirmation that the affected component was a superseded SSO registration function still called by an internal system, and a clearer list of exposed fields.
2026.10.05
100% relevant
This article appears to be the initial public reporting of Bromcom's breach disclosure, with concrete details on the affected legacy SSO component, exposed data types, and the company's mitigation steps.
← Back to all stories