Free tools Windows power users keep installed
One-click scans. No signup required.
Bromcom says a superseded single sign-on (SSO) registration feature left in production was involved in an IT incident first identified on 6 September 2026. In its FAQ updated 30 September, the school-software provider said it had found no evidence of MIS data access or successful account takeover, but the nature and scope of any data involved remained under investigation. The incident concerned Bromcom’s Communication Server environment, not the MIS database, according to the company.
What happened at Bromcom?
Bromcom says the incident involved legacy SSO registration functionality in its Communication Server environment. The function had been superseded but remained in production because an internal system was still calling it. Bromcom says it identified the incident on 6 September 2026 after receiving reports of SSO access problems. Bromcom’s FAQ, updated 30 September 2026, describes its account of the incident and response.
As an Amazon Associate I earn from qualifying purchases.
SSO lets a user sign in to a service using an identity provider such as Microsoft or Google. Bromcom says the affected functionality handled registrations associated with those sign-ins; it says the component did not hold account passwords, access tokens, refresh tokens or session tokens.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Was pupil or school data accessed?
Bromcom said in its 30 September FAQ that it had found no evidence that school MIS data was accessed or that the MIS database was involved. It also said its investigation had not identified a successful unauthorised sign-in to the MIS, MyChildAtSchool or a Bromcom user account, or a successful account takeover arising from the incident. These are Bromcom’s reported findings to date, not an independently confirmed final determination.
#1 Best Overall
The Register reported on 6 October 2026 that the service held email addresses associated with SSO registrations, the identity provider used, registration and last sign-in dates where recorded, and internal user and registration reference numbers. That description does not establish that all those records were accessed or copied. Bromcom’s FAQ said the nature and scope of data potentially involved remained under investigation. Bromcom’s FAQ and The Register’s 6 October report are the sources for these separate accounts.
Were passwords or Microsoft and Google accounts exposed?
Bromcom says the legacy component did not contain passwords or authentication tokens. It has reported no successful account takeover arising from the incident. Those statements do not establish that no registration-related information was involved: Bromcom had not yet determined the full nature and scope of data potentially affected in its 30 September update.
Rank #2
The Register described the identity-provider field as including providers such as Microsoft or Google. That is not the same as a finding that Microsoft or Google credentials were exposed. Bromcom’s account does not report evidence of successful sign-in to school systems or accounts, but its investigation was still ongoing.
What has Bromcom done, and what remains unclear?
Bromcom says it withdrew the legacy functionality from production, restored SSO access to reduce disruption, and added safeguards. It reports introducing additional school and account authorisation checks, limiting self-service removal to the signed-in user’s own registration, and improving operation-specific logging and security audit records. The company also says email-address records were recovered and recovery activity was undertaken for SSO registrations. Bromcom’s FAQ outlines these steps.
The identity of affected schools and individuals, and the final scope of any data accessed or copied, were not established in Bromcom’s 30 September update. Bromcom said it was continuing its investigation and school-level validation. The Register reported that Bromcom’s software is used by more than 5,000 schools and 390 multi-academy trusts; those are company footprint figures, not counts of schools affected by this incident. The Register reported the figures on 6 October 2026.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should a school using Bromcom do now?
Bromcom says it is contacting relevant data controllers so they can assess the incident and decide on appropriate next steps. Schools should use direct communications from Bromcom to establish whether their organisation or users are in scope rather than infer impact from login symptoms alone. Sector commentary from DPE advises schools to make their own data-controller assessment and notes that a school could be affected even if users did not experience login problems.
Rank #4
- Check Bromcom’s direct notice and current incident information for school-specific details, including whether any registrations or records associated with your users are implicated.
- Record any SSO access disruption separately from questions about data exposure. A login problem does not by itself demonstrate data access, and the absence of a login problem does not establish that a school is unaffected.
- Ask Bromcom what information is known about your school’s registrations, any recovery actions, and the status of its investigation; document the answers for your organisation’s assessment.
- Follow your school or trust’s established incident and data-protection procedures, using the facts Bromcom provides and your own assessment rather than assuming a particular outcome.
Bromcom’s FAQ says the company had not notified the ICO about this incident, explaining that it acted as a data processor for data held on the communications server. That is Bromcom’s stated position in this case, not general legal guidance for schools.
Quick Recap
Best Value
- Great extension activities for science and biology
- Correlated to standards
- Comprehensive biology vocabulary study
- Fascinating true-to-life illustrations
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
