We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
Thousands of pupils’ personal data at risk in website hack

Thousands of pupils’ personal data at risk in website hack

Hack involved one of the school's own pupils

Article comments

The Information Commissioner’s Office (ICO) has found a school in Hampshire in breach of the Data Protection Act (DPA) after the personal details of nearly 20,000 people were put at risk when the school’s website was hacked.

According to an undertaking signed by Bay House School, computer hackers, including at least one of its own pupils, accessed the school’s internal information management system via an attack on the school’s remotely-hosted website.

In March, hackers gained access to the system after discovering that a member of staff used the same password to log into the school’s web and management systems. Despite Bay House School having a policy in place to prohibit the use of duplicate passwords, the school did not have checks in place to ensure the policy was adhered to.

As a result, the personal details of 20,000 individuals, including teachers, parents and around 7,600 pupils risked being exposed online. The data included names, addresses, photographs and some sensitive medical history information.

The problem was identified shortly after the hack occurred and the security of the website was immediately restored.

The school will now ensure that reasonable measures are taken to encrypt and separate sensitive and confidential information held on the school’s management system. It will also remind staff of the duplicate passwords policy, and at least annually carry out penetration testing on the school’s IT systems  to ensure the personal information held remains secure.

“While it can be difficult to remember lots of different passwords, it is vitally important that individuals do not use the same password to log in to data systems that are supposed to be kept secure. This is particularly important when the systems allow access to sensitive information relating to young adults,” said Sally Anne Poole, acting head of enforcement at the ICO.

Share:

Comments

Advertisement
Send to a friend

Email this article to a friend or colleague:


PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.


ComputerworldUK Knowledge Vault

ComputerworldUK
Share
x
Open
* *