Bromcom says a breach involved a legacy single sign-on (SSO) registration feature in its Communication Server environment. The company says the component contained registration-related information, not passwords or authentication tokens, and reports that it found no evidence school MIS data was accessed. The scope—including how many users or records were affected—was still being investigated in Bromcom’s FAQ updated 30 September 2026.
What happened in the Bromcom SSO breach?
Bromcom says it first identified the incident on 6 September 2026, after reports of SSO access problems. Its FAQ says the issue involved legacy SSO registration functionality in the Communication Server environment. Bromcom says the functionality had been superseded but remained in production because an internal system continued to call it.
As an Amazon Associate I earn from qualifying purchases.
Bromcom reported restoring SSO access and withdrawing the legacy functionality from production. The Register covered the incident on 5 October 2026, while Bromcom’s FAQ was updated on 30 September.
What information may have been involved?
Bromcom describes the data held by the affected component as information associated with SSO registrations. The company says this could include:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Email addresses associated with SSO registrations.
- The SSO provider, such as Microsoft or Google.
- Registration and last sign-in dates, where held.
- Internal user and registration reference numbers.
Bromcom said its investigation into the nature and scope of the data involved was ongoing. The company had not established the number of affected users or records in the FAQ updated 30 September 2026, and it said school-level information was still being validated.
Were passwords, Microsoft or Google accounts, or school MIS data compromised?
Bromcom says the affected component did not store passwords, access tokens, refresh tokens, session tokens, or similar authentication credentials. It also says the component was separate from Microsoft and Google authentication services.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Bromcom states that it found “no evidence that school MIS data was accessed or that the MIS database was compromised.” It also reports that the investigation had not identified successful unauthorized sign-in to the MIS, MyChildAtSchool, or a Bromcom user account, or successful account takeover arising from the incident. These are Bromcom’s reported findings, not an independent confirmation that no information was accessed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What has Bromcom changed?
Bromcom says it removed the legacy functionality from production and restored SSO access. Its FAQ also lists additional school and account authorization checks, restrictions so users can remove only their own registration through self-service, and improved operation-specific logging and audit records. The company said it was continuing forensic work with external specialists.
Rank #3
- Strict tolerances offer ultimate in strength and durability
- Provide an added layer or protection for your most valuable assets from keys and utillity knves to medical equipment, cash tills and more.
- Rings cannot be opened without detection, thus preventing asset substitution.
- Stamped with unique serial number to audit rings and assets and prevent substitutions.
- Key rings crimp to smooth seal and keys are able to rotate the full 360 degrees to prevent bunching.
What should schools and staff do?
Bromcom says schools need no specific steps as a result of the incident. It recommends staying alert for suspicious messages, calls, or emails, especially those asking recipients to click links, provide credentials, approve a sign-in request, or reset a password. Schools should also review information Bromcom sends them and assess the incident in their role as data controllers.
Bromcom says it had not notified the Information Commissioner’s Office (ICO) about this incident and was contacting relevant data controllers so they could assess it and determine appropriate next steps. Separately, the ICO’s general guidance on security breaches under the Privacy and Electronic Communications Regulations (PECR) says covered service providers must notify the ICO, consider notifying customers, and keep a breach log; the guidance records a 72-hour reporting period from 20 August 2025. These separate statements do not determine how those rules apply to Bromcom’s incident.
Quick Recap
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Sources
- Bromcom Documentation Centre: SSO Personal Data Breach FAQs (updated 30 September 2026).
- Information Commissioner’s Office: Security breaches (guidance updated 20 August 2025).
- The Register: Legacy sign-on service comes back to bite school software provider Bromcom (5 October 2026).
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
