“Pret-a-Portrait has informed us that, overnight between 6 and 7 October, one of its vehicles was broken into and a camera bag containing SD memory cards was stolen,” wrote Jon Curtis-Brignell, headteacher at Priory School in Lewes.
What was stolen and what might be exposed
Pret-a-Portrait notified Priory School that a camera bag holding SD memory cards was taken during a break-in overnight between 6 and 7 October. The headteacher said some of those cards may have contained photographs taken at Priory School and images of the QR code cards used for school photographs, “which show pupils’ names and class names.” The school’s email described the potentially affected information narrowly: photographs, pupils’ names and their class information associated with the photography process. The headteacher also made clear that other pupil data — addresses, contact details, financial information, medical information and safeguarding records — held in the school’s own systems were not touched.
Pret-a-Portrait’s account and immediate technical findings
Pret-a-Portrait, which has offices in the UK, Qatar and the UAE, told the school it believes “most, if not all” of the files containing pupils’ data will have been overwritten, but that it cannot be certain. The company’s owner, Nick Kerr, told The Register that no physical, printed photos were stored in the vehicle at the time of the break-in and that it was not possible to determine the full scope of any data protection violation. Kerr also said: “Our analysis reveals that no improper access to pictures from this job occurred in between the time of the theft and the pictures being taken offline.” He added that the likely exposure ranges “somewhere between a small subset of their pictures and none of them.”
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTimeline of the commission and reuse of equipment
- October 1: Pret-a-Portrait visited Priory School to take annual school photographs.
- Between October 1 and October 6–7: The same equipment used at Priory was subsequently used on three additional photography jobs.
- Overnight between October 6 and 7: A Pret-a-Portrait vehicle was broken into and the camera bag with SD cards was stolen.
- After the theft: Pret-a-Portrait informed Priory School, took school photos offline, changed access IDs, and altered procedures for handling SD cards; the company reported the incident to police and the ICO.
Pret-a-Portrait’s mitigation steps and procedural changes
According to the headteacher’s email, Pret-a-Portrait took several concrete steps after discovering the theft: it removed all school photos from online access, changed the IDs used to access the photographs, and changed its operational procedures so that all SD cards are wiped at the end of each commission. The company also said it “reviewed and strengthened its procedures following the incident” and reported the matter to both the police and the Information Commissioner’s Office (ICO).
How Data Protection Officers, parents, and school procurement are responding
- Data Protection Officer (DPO): The headteacher said the school “worked closely with our Data Protection Officer and Pret-a-Portrait to understand what happened, establish the potential risk and ensure that appropriate action has been taken.” The DPO’s involvement in the school’s account signals a formal risk assessment and coordination with the vendor.
- Parents and families: The headteacher communicated directly to families to be open about the incident and to reassure them that “there is currently no evidence that the information has been accessed or misused.”
- School procurement and vendor management: Pret-a-Portrait reported procedural changes — wiping SD cards at the end of commissions and restricting online access — steps the school and similar buyers are likely to scrutinize when assessing vendor handling of transient storage media.
The factual record from the school and from Pret-a-Portrait leaves a clear, narrow core: SD cards were stolen from a photographer’s vehicle and those cards may have contained school photographs and identification images that link names and classes. Pret-a-Portrait asserts most files were likely overwritten and reports no evidence of improper access, while the school reports that other sensitive pupil data in its own systems were unaffected. The police and the ICO have been informed; beyond that, the central uncertainty remains the extent to which any images that originated at Priory were recoverable on the stolen media.
