Bromcom: Bromcom notifies customers of personal data breach affecting SSO technology

Bromcom Reports Data Breach Affecting UK Education SSO System

UK-based education software provider Bromcom has disclosed a data breach impacting its single sign-on (SSO) technology, exposing limited personal information. The incident, detected on September 6, involved unauthorized access to the company’s Communication Server environment, specifically a legacy SSO registration feature.

Affected data includes email addresses, SSO registration details (such as linked Microsoft or Google accounts), and internal user reference numbers. Bromcom confirmed that passwords, authentication tokens, and its core school Management Information System (MIS) remained secure. The company has since disabled the vulnerable legacy functionality and is working with forensic specialists to assess the full scope of the breach.

The incident underscores persistent security risks in educational technology, even when primary data systems remain uncompromised. No further details on the attack vector or potential threat actors have been released.

Source: https://www.scworld.com/brief/bromcom-notifies-customers-of-personal-data-breach-affecting-sso-technology

Bromcom cybersecurity rating report: https://www.rankiteo.com/company/bromcom

"id": "BRO1791240428",
"linkid": "bromcom",
"type": "Breach",
"date": "9/2026",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'industry': 'Education Technology',
                        'location': 'UK',
                        'name': 'Bromcom',
                        'type': 'Education Software Provider'}],
 'data_breach': {'personally_identifiable_information': 'Email addresses, SSO '
                                                        'registration details',
                 'sensitivity_of_data': 'Limited personal information (email '
                                        'addresses, SSO registration details, '
                                        'internal user reference numbers)',
                 'type_of_data_compromised': 'Personal Information'},
 'date_detected': '2023-09-06',
 'description': 'UK-based education software provider Bromcom has disclosed a '
                'data breach impacting its single sign-on (SSO) technology, '
                'exposing limited personal information. The incident involved '
                'unauthorized access to the company’s Communication Server '
                'environment, specifically a legacy SSO registration feature.',
 'impact': {'data_compromised': 'Email addresses, SSO registration details '
                                '(linked Microsoft or Google accounts), '
                                'internal user reference numbers',
            'systems_affected': 'Communication Server environment (legacy SSO '
                                'registration feature)'},
 'investigation_status': 'Ongoing',
 'response': {'containment_measures': 'Disabled the vulnerable legacy '
                                      'functionality',
              'third_party_assistance': 'Forensic specialists'},
 'title': 'Bromcom Reports Data Breach Affecting UK Education SSO System',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Legacy SSO registration feature'}