Emerging ThreatsData Breaches

Bromcom Breach Exposes Email Addresses in Legacy Sign-on Flaw

Analyst 207||Source: TheRegister
School office with computer, printer, and papers on a desk, hint of network equipment in background.

More than 5,000 schools and 390 multi-academy trusts rely on Bromcom's software — and a legacy piece of that stack has just exposed personal data tied to single sign-on registrations.

How the intrusion occurred: legacy SSO registration in the Communication Server

Bromcom has notified customers that an unauthorized third party accessed a legacy single sign-on (SSO) registration component in the supplier's Communication Server environment. The company said the affected functionality was a legacy registration mechanism that had remained in production after being superseded because, in Bromcom's words, "it was still being called by an internal system."

The incident was first identified on September 6 after reports of SSO access problems, and the legacy functionality has been withdrawn from production while Bromcom works with external forensic specialists to determine scope and nature of the data involved.

What data was taken

Bromcom said the compromised component held email addresses associated with SSO registrations, the provider used for those registrations (for example, Microsoft or Google), recorded registration and last sign-in dates where available, and internal user and registration reference numbers. The company stated the affected component did not hold account passwords or authentication tokens.

According to a September 24 EduGeek post from an account named Bromcom_Alastair, an unauthorized third party "accessed and retrieved email addresses and limited information associated with affected SSO registrations."

Timeline and customer notification

According to Bromcom's disclosures, the supplier identified the issue on September 6 after users reported problems with SSO access. The public post notifying customers and the wider community appeared on September 24 on the EduGeek forum. Bromcom has confirmed it is engaging external forensic specialists to investigate.

In an FAQ cited by the vendor, Bromcom said its school Management Information System (MIS) — the platform used to manage student data, attendance, behaviour, and administration — showed no evidence of compromise.

Limits of the breach: authentication providers and account access

Bromcom emphasised that the incident did not enable access to Microsoft or Google accounts because those providers' authentication services are separate from the affected SSO registration component. The company also said passwords and authentication tokens were not held in the impacted service.

The Register has asked Bromcom to comment further.

What this means for schools, multi-academy trusts, and procurement/IT teams

  • Schools and multi-academy trusts: organisations that use Bromcom's MIS and related services will be watching notifications about which users and emails were affected and may need to check local user records and communications to parents and staff where appropriate.
  • Procurement and IT teams at customers (including recent customers named by Bromcom such as Newport City Council, the Ministry of Defence, Warwickshire County Council, and the Northern Ireland Education Authority): will need to confirm whether their implementations relied on the legacy registration path and coordinate with Bromcom on any remediation or audit activity.
  • Microsoft and Google: while Bromcom says their authentication services were not exposed by the affected component, these providers will be one part of any follow-up verification where customers need reassurance that OAuth/identity flows and tokens were not implicated.

The immediate facts are straightforward: a superseded SSO registration component that remained callable by internal systems was accessed, some registration metadata and email addresses were taken, and Bromcom has removed the legacy functionality and engaged forensic experts. The event highlights the operational risk posed by dormant or superseded code paths still invoked by live systems. Bromcom's FAQ asserts no MIS compromise and no passwords or tokens were exposed; how confidence in that conclusion is reached will depend on the ongoing forensic work and any further disclosures the vendor makes to customers and regulators.

Original story: https://www.theregister.com/security/2026/10/05/legacy-sign_on_service_comes_back_to_bite_school_software_provider_bromcom/5301156

Data BreachEmerging ThreatsLegacy SystemsSupply ChainUkEducation SectorSingle Sign-OnBromcomMulti-Academy Trusts
Related Intelligence

Continue Reading

Municipal water treatment plant with industrial controls and operator at panel.

US Water Systems Face Growing Cyber Threats

US water systems are under siege by cyber threats from hostile nations like China, Russia, Iran, and North Korea, as well as ransomware groups, putting our critical infrastructure at risk of a nationwide public-health crisis. This summer's alarming attacks on water systems in 12 states by Iranian hackers exposed the vulnerability of our water infrastructure to foreign adversaries.

Analyst 207
Interior of Danish civic building with people in background and computer workstation in foreground.

Denmark's Population Registry Breach Exposes 8.8 Million

A massive data breach has hit Denmark's Central Population Register, compromising sensitive personal info for a whopping 8.8 million people - that's nearly 80% of the country's population! Names, addresses, dates of birth, and more are now at risk.

Analyst 207
Close-up of a computer processor on a laboratory bench with blurred scientific equipment in the background.

Citrix NetScaler Flaw Actively Exploited in Targeted Attacks

Researchers have uncovered a new Spectre v2 variant, called Branch Target Reuse (BTR), which can extract sensitive data, including root password hashes, from Intel machines running Linux in just minutes. This attack leverages a clever exploit that takes advantage of a desynchronization in modern CPUs.

Analyst 207
Mail security gateway device centered in a clean, neutral background.

Malicious Backdoors Infiltrate Telecoms via Email Traffic Disguise

Malicious backdoors are sneaking into telecom systems by masquerading as regular email traffic, making them nearly undetectable. Researchers at Rapid7 uncovered an implant family called AVERAT that cleverly disguises itself as legitimate mail activity on TCP port 25 and SMTP.

Analyst 207