We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

Thousands of pupils’ personal data at risk in website hack

Hack involved one of the school's own pupils

The Information Commissioner's Office (ICO) has found a school in Hampshire in breach of the Data Protection Act (DPA) after the personal details of nearly 20,000 people were put at risk when the school's website was hacked.

According to an undertaking signed by Bay House School, computer hackers, including at least one of its own pupils, accessed the school's internal information management system via an attack on the school's remotely-hosted website.

In March, hackers gained access to the system after discovering that a member of staff used the same password to log into the school's web and management systems. Despite Bay House School having a policy in place to prohibit the use of duplicate passwords, the school did not have checks in place to ensure the policy was adhered to.

As a result, the personal details of 20,000 individuals, including teachers, parents and around 7,600 pupils risked being exposed online. The data included names, addresses, photographs and some sensitive medical history information.

The problem was identified shortly after the hack occurred and the security of the website was immediately restored.

The school will now ensure that reasonable measures are taken to encrypt and separate sensitive and confidential information held on the school's management system. It will also remind staff of the duplicate passwords policy, and at least annually carry out penetration testing on the school's IT systems to ensure the personal information held remains secure.

"While it can be difficult to remember lots of different passwords, it is vitally important that individuals do not use the same password to log in to data systems that are supposed to be kept secure. This is particularly important when the systems allow access to sensitive information relating to young adults," said Sally Anne Poole, acting head of enforcement at the ICO.

IDG UK Sites

6 best gaming PCs 2015: What's the best gaming PC you can buy in the UK?

IDG UK Sites

Three of the most expensive Limited Edition games ever made: Who's buying a $1,000,000 game?

IDG UK Sites

The future of Microsoft Surface: What to expect from the Surface Pro 4

IDG UK Sites

Best Mac: Apple Mac buyers guide for 2015: iMac, MacBook, MacBook Air, MacBook Pro, Mac mini and...