Nottinghamshire County Council Apologizes After Exposing Parents’ Personal Data in Email Breach
Nottinghamshire County Council has issued an apology following a data breach that exposed the personal details of parents and students in an email about school bus passes. The incident occurred on Friday when an internal mail merge project intended to send payment reminders inadvertently included sensitive information.
The email, reviewed by the BBC, contained full names and reference numbers of dozens of students, along with the names and email addresses of parents and carers. Additionally, it disclosed individual costs for renewing school transport passes.
A council spokesperson confirmed the breach and stated that an internal investigation determined the incident met the threshold for reporting to the UK’s Information Commissioner’s Office (ICO). A follow-up email later that day acknowledged the error, apologized, and instructed recipients to permanently delete the original message and refrain from sharing its contents. The council also launched an investigation to identify the cause and prevent future occurrences.
Source: https://ca.news.yahoo.com/council-apologises-parent-email-data-113801274.html
Nottinghamshire County Council cybersecurity rating report: https://www.rankiteo.com/company/nottinghamshire-county-council
"id": "NOT1785263548",
"linkid": "nottinghamshire-county-council",
"type": "Breach",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Dozens of parents and students',
'industry': 'Public Sector',
'location': 'Nottinghamshire, UK',
'name': 'Nottinghamshire County Council',
'size': 'Large (public sector organization)',
'type': 'Government (Local Council)'}],
'attack_vector': 'Human Error (Internal Mail Merge Misconfiguration)',
'customer_advisories': 'Follow-up email instructing recipients to delete the '
'original message and refrain from sharing its '
'contents',
'data_breach': {'number_of_records_exposed': 'Dozens',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (personally identifiable '
'information)',
'type_of_data_compromised': ['Full names',
'Reference numbers',
'Email addresses',
'Individual costs for school '
'transport passes']},
'date_detected': '2023-11-03',
'date_publicly_disclosed': '2023-11-03',
'description': 'Nottinghamshire County Council issued an apology following a '
'data breach that exposed the personal details of parents and '
'students in an email about school bus passes. The incident '
'occurred when an internal mail merge project intended to send '
'payment reminders inadvertently included sensitive '
'information such as full names, reference numbers, and email '
'addresses.',
'impact': {'brand_reputation_impact': 'Yes (public apology issued)',
'data_compromised': 'Personal details of parents and students, '
'including full names, reference numbers, '
'email addresses, and individual costs for '
'renewing school transport passes',
'identity_theft_risk': 'Yes (exposure of personally identifiable '
'information)',
'legal_liabilities': 'Potential (reported to ICO)',
'operational_impact': 'Internal investigation launched, follow-up '
'communications required',
'systems_affected': 'Email system (internal mail merge process)'},
'investigation_status': 'Ongoing',
'references': [{'date_accessed': '2023-11-03', 'source': 'BBC'}],
'regulatory_compliance': {'regulations_violated': ['UK Data Protection Act '
'2018',
'GDPR'],
'regulatory_notifications': 'Reported to the UK '
'Information '
'Commissioner’s Office '
'(ICO)'},
'response': {'communication_strategy': 'Public apology and follow-up email to '
'affected individuals',
'containment_measures': 'Follow-up email instructing recipients '
'to delete the original message and '
'refrain from sharing its contents',
'incident_response_plan_activated': 'Yes (internal investigation '
'launched)',
'remediation_measures': 'Investigation to identify the cause and '
'prevent future occurrences'},
'title': 'Nottinghamshire County Council Data Breach Exposing Parents’ '
'Personal Data',
'type': 'Data Breach'}