INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Bromcom's Legacy Sign-On Service Compromised by Phishing Attack

| 2026-10-06 09:30 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A personal data breach affecting Bromcom's single sign-on (SSO) technology occurred on September 6, when an unauthorized third party accessed and retrieved email addresses associated with affected SSO registrations. The incident involved legacy SSO registration functionality in Bromcom's Communication Server environment, which had remained in production despite being superseded due to its continued use by an internal system. The breach did not enable access to Microsoft or Google accounts, whose authentication services are separate from the affected component. As a result of this data breach, email addresses associated with SSO registrations were compromised, affecting over 5,000 schools and 390 multi-academy trusts in the UK education sector. Bromcom is currently working with external forensic specialists to determine the nature and scope of the data involved, while also liaising with affected schools and authorities to resolve any disruption caused by this incident.
Technical Mitigations AI-generated
• Patch Bromcom's Communication Server environment to remove the legacy SSO registration functionality. • Block or hunt for unauthorized access attempts using internal user and registration reference numbers, which were recorded by the affected component. • Use a secure authentication service like Microsoft or Google that is separate from the affected component.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES educationeducation
Incident Timeline
‎September 6
Threat actors exploited a legacy sign-on service used by Bromcom, causing SSO access problems that were later resolved by withdrawing the affected functionality from production.
‎September 24
An unauthorized third party accessed and retrieved email addresses and limited information associated with affected SSO registrations on September 24.
organisation SSO
In a September 24 EduGeek post , an account named Bromcom_Alastair said an unauthorized third party had accessed and retrieved email addresses and limited information associated with affected SSO registrations.
‎October 6
Threat actors exploited a vulnerability in Bromcom's legacy sign-on service, prompting the company to identify and contain an IT incident.
organisation UTC
® Updated to add at 0834 UTC, October 6 A spokesperson for Bromcom said: "We recently identified, contained and began investigating an IT incident.
‎2026/10/06
Threat actors retrieved email addresses from superseded tech kept running for an internal system.
organisation Newport City Council
Recent customer wins include Newport City Council, the Ministry of Defence, Warwickshire County Council, and the Northern Ireland Education Authority.
organisation the Ministry of Defence,
Recent customer wins include Newport City Council, the Ministry of Defence, Warwickshire County Council, and the Northern Ireland Education Authority.
organisation Warwickshire County Council
Recent customer wins include Newport City Council, the Ministry of Defence, Warwickshire County Council, and the Northern Ireland Education Authority.
organisation the Northern Ireland Education Authority
Recent customer wins include Newport City Council, the Ministry of Defence, Warwickshire County Council, and the Northern Ireland Education Authority.
organisation Bromcom
The incident involved legacy SSO registration functionality in Bromcom's Communication Server environment.
organisation Management Information System
The company confirmed in an FAQ it found no evidence that its school Management Information System (MIS), used to manage student data, attendance, behaviour, and administration, was compromised.
organisation MIS
The company confirmed in an FAQ it found no evidence that its school Management Information System (MIS), used to manage student data, attendance, behaviour, and administration, was compromised.
organisation Microsoft
The service held email addresses associated with SSO registrations, the provider used, such as Microsoft or Google, registration and last sign-in dates where recorded, and internal user and registration reference numbers.
organisation Google
The service held email addresses associated with SSO registrations, the provider used, such as Microsoft or Google, registration and last sign-in dates where recorded, and internal user and registration reference numbers.
organisation The Register
The Register has asked Bromcom to comment further.
Intelligence Sources
The Register - CSO 2026-10-06