{
  "id": 12347762,
  "title": "Legacy sign-on service comes back to bite school software provider Bromcom",
  "url": "https://urgent.news/2026/10/06/legacy-sign-on-service-comes-back-to-bite-school-software-provider",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-06T09:30:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/06/legacy-sign-on-service-comes-back-to-bite-school-software-provider-bromcom/5301156"
  },
  "original_language": "en",
  "account": "UK education software firm Bromcom has informed its customers of a personal data breach affecting its single sign-on (SSO) technology. The breach, discovered on September 6, involved unauthorized access to email addresses and limited information linked to SSO registrations in Bromcom's Communication Server environment. The company's FAQ stated no evidence of compromise to its school Management Information System (MIS), which manages student data, attendance, behavior, and administration. Bromcom identified the issue and removed the legacy SSO registration functionality from production the same day. The compromised component did not store account passwords or authentication tokens. Bromcom confirmed the affected service held email addresses associated with SSO registrations, such as Microsoft or Google, registration and last sign-in dates, and internal user and registration reference numbers. The legacy SSO registration functionality, still being called by an internal system, had remained in production after being replaced. Bromcom's software is used by over 5,000 schools and 390 multi-academy trusts in the UK. The company stated its investigation was ongoing and liaising with affected schools, trusts, and relevant authorities.",
  "summary": "Intruders retrieved email addresses from superseded tech kept running for an internal system",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "Legacy sign-on service comes back to bite school software provider Bromcom",
        "url": "https://urgent.news/2026/10/06/legacy-sign-on-service-comes-back-to-bite-school-software-provider-12350068",
        "published": "2026-10-06T09:30:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}