Old sign on system causes data breach for school software firm Bromcom

UK-based education software firm Bromcom recently notified clients of a data breach involving its legacy single sign-on (SSO) technology. The security incident, which the company identified on September 6 following reports of access issues, targeted the registration functionality within its Communication Server environment. An unauthorized party successfully retrieved specific details, including email addresses, internal registration reference numbers, and the identity of third-party providers like Google or Microsoft. The stolen data also included registration dates and the most recent sign-in timestamps where available.

Bromcom has since removed the vulnerable legacy component from its production environment and engaged external forensic experts to investigate the full extent of the exposure. While the breach impacted SSO registration data, the company confirmed that its core Management Information System (MIS)—which handles sensitive student administration, attendance, and behavioral records—remained secure and uncompromised. Organizations utilizing these services should promptly evaluate their exposure and implement necessary security updates to safeguard critical information and systems.