We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Thousands of pupils’ personal data at risk in website hack

Hack involved one of the school's own pupils

The Information Commissioner's Office (ICO) has found a school in Hampshire in breach of the Data Protection Act (DPA) after the personal details of nearly 20,000 people were put at risk when the school's website was hacked.

According to an undertaking signed by Bay House School, computer hackers, including at least one of its own pupils, accessed the school's internal information management system via an attack on the school's remotely-hosted website.

In March, hackers gained access to the system after discovering that a member of staff used the same password to log into the school's web and management systems. Despite Bay House School having a policy in place to prohibit the use of duplicate passwords, the school did not have checks in place to ensure the policy was adhered to.

As a result, the personal details of 20,000 individuals, including teachers, parents and around 7,600 pupils risked being exposed online. The data included names, addresses, photographs and some sensitive medical history information.

The problem was identified shortly after the hack occurred and the security of the website was immediately restored.

The school will now ensure that reasonable measures are taken to encrypt and separate sensitive and confidential information held on the school's management system. It will also remind staff of the duplicate passwords policy, and at least annually carry out penetration testing on the school's IT systems to ensure the personal information held remains secure.

"While it can be difficult to remember lots of different passwords, it is vitally important that individuals do not use the same password to log in to data systems that are supposed to be kept secure. This is particularly important when the systems allow access to sensitive information relating to young adults," said Sally Anne Poole, acting head of enforcement at the ICO.

IDG UK Sites

Best camera phone of 2015: iPhone 6 Plus vs LG G4 vs Galaxy S6 vs One M9 vs Nexus 6

IDG UK Sites

In defence of BlackBerrys

IDG UK Sites

Why we should reserve judgement on Apple ditching Helvetica in OS X/iOS for the Apple Watch's San...

IDG UK Sites

Retina 3.3GHz iMac 27in preview: Apple cuts £400 of price of Retina iMac with new model