Legacy sign-on service comes back to bite school software provider Bromcom

Legacy SSO registration in Bromcom's Communication Server was accessed by an unauthorized third party, exposing email addresses and limited registration metadata; Bromcom states no MIS data, passwords, or authentication tokens were compromised, has withdrawn the legacy functionality from production, identified the incident on September 6, and is investigating with external forensic specialists while notifying affected schools and trusts.