An email arrives asking you to reconnect your school account. It names the right school. It mentions the system you use. There may even have been a recent problem signing in. Would you question it?
That is one of the concerns following Bromcom’s disclosure of a breach affecting its single sign-on registration service. When information about school accounts falls into the wrong hands, it can provide useful material for a convincing phishing message.
What Bromcom stated on 25 September
In its FAQ updated on 25 September, Bromcom stated that an unauthorised party retrieved staff and pupil SSO registration information, including email addresses, sign-in provider details and internal references. Some pupil registrations used personal email addresses.
The affected functionality linked Microsoft or Google accounts to Bromcom. It was separate from the MIS database and those providers’ authentication services.
Bromcom says passwords and authentication tokens were not returned, and it has found no evidence of successful MIS data access or account takeover arising from the incident.
Its investigation identified affected schools where registrations had not been deleted, so an absence of login disruption does not establish that a school was unaffected.
Why school MIS providers are attractive targets
A school management information system brings together information needed to run a school: pupil details, attendance, assessment and other operational records. Suppliers serving many schools can hold substantial volumes of valuable information.
That concentration makes school technology providers an attractive prospect for criminals. A weakness at one supplier can potentially affect multiple organisations.
The Department for Education’s own guidance highlights the sensitive information held by third-party suppliers and the importance of checking how they protect school data and systems.
However, the value of the wider MIS must not be confused with the scope of this particular breach. We should explain the risk without suggesting that records were stolen when the evidence does not support that.
An email address can help make the next message believable
Many school email addresses are already public. That does not make every disclosure harmless.
Context matters. Knowing where someone works or studies, and which service they use, can help an attacker write a message that fits their day.
For example, a criminal could send a message claiming:
Your school login needs reconnecting following a technical problem.
You must complete a security check to retain access.
A supplier has issued an urgent account update.
These are illustrative scenarios, not confirmed messages associated with this incident.
The danger is that a familiar explanation can make an unfamiliar request feel reasonable. A busy member of staff might be expecting an IT update and encounter a fraudulent one at exactly the wrong moment.
“Criminals don’t always need your password from the first breach. Sometimes they need enough information to make the next email believable.”
– Kevin Walker, Black Swan Cyber Security Solutions
What should schools do now?
Ask for information specific to your school
Contact the supplier through an established support route. Ask whether your school is affected, which individuals and information are involved, what remains under investigation and whether any action is outstanding.
Give that information to your data protection officer and IT support team so they can assess it together. Keep a record of the advice received and the decisions made.
Avoid relying on a general reassurance when you need an answer about your own school.
Explain how genuine support will contact people
“Be vigilant” is not much help on its own.
Tell staff how legitimate account-recovery instructions will arrive and who they can contact to check a message. Encourage them to open the service through their usual bookmark or school portal rather than following an unexpected email link.
If a message asks for a password, an authentication code or approval of an unexpected sign-in, pause and check through a known route.
Where pupils need guidance, make it age-appropriate and coordinate it with the school’s safeguarding and data protection leads.
Follow evidence, rather than resetting everything automatically
Bromcom’s current advice does not call for a general password reset or token revocation solely because of this incident. That advice is based on the information its investigation found had been retrieved.
A separate suspicious sign-in or a person reporting that they entered their details into a questionable page needs its own investigation. The response should follow what happened to that account.
Put protection around the person
People should have support before and after a suspicious message reaches them.
We recommend a layered approach to phishing: reduce the number of malicious messages reaching users, help people recognise and report them, limit the damage when an attack succeeds and respond quickly.
For schools, that means reviewing email protection, account security, access permissions and the process for responding to a report. It also means making it safe to speak up.
After years supporting school IT, I know how busy a school office can be. A security process has to work when the phone is ringing, someone is waiting at reception and a member of staff needs help getting into a lesson.
Supplier security belongs in the conversation before an incident
Schools cannot inspect every line of code their suppliers write., but they shouldask clear questions about responsibilities.
Who will contact the school if something happens? How will affected records be identified? What evidence will be provided? Who is responsible for checking that recovery is complete?
These questions belong in supplier reviews and contract discussions, alongside cost, features and support.
A school should know who to call and what to expect before it needs those answers urgently.
Clear facts and useful action
There is a balance to strike here. Schools need accurate information about what was accessed, without speculation about a wider compromise. They also need to understand how exposed information could be used later.
At Black Swan Cyber Security Solutions, we help schools review supplier risk, strengthen email and account protection and turn technical warnings into practical steps.
If your school needs help understanding a supplier notification or reviewing its protection against phishing, get in touch for a plain-English conversation.
Incident details are based on Bromcom’s SSO Personal Data Breach FAQ, updated 25 September 2026 and checked on 28 September. The investigation is ongoing.
Update: 1 October 2026
Bromcom revised its public FAQ on 30 September, after this article was written. Its wording has changed materially.
The 25 September version explicitly confirmed unauthorised retrieval of SSO registration information. The revised FAQ says external forensic specialists are still investigating the nature and scope of the data involved, including whether information was accessed or copied.
Bromcom has not explained why those earlier confirmations have been replaced. The revised wording does not, by itself, establish that the previous findings were incorrect.
It now also explains that the affected SSO functionality had been superseded but remained operational because an internal system still used it. Bromcom says this legacy functionality has been withdrawn.
Its position remains that there is no evidence of MIS compromise or successful account takeover, and that the component did not hold passwords or authentication tokens. School-specific record lists are still being verified.
The discussion below reflects Bromcom’s statement dated 25 September. Schools should consult its latest FAQ and direct communications when assessing their own position.
The practical concern about convincing phishing messages remains relevant, but follow-on phishing arising from this incident should not be presented as confirmed.
Read Bromcom’s latest SSO personal data breach FAQ.
