Important: Groupcall Security Notice

[Seb1780]

One of our SLT has recieved this from Groupcall, neither I (Data Manager) nor our Network Manager have.

 

Has anyone else seen this? Is this really happening that people are calling saying they are Groupcall?

 

Data Security Notice from Groupcall.

 

We have been notified by some of our school customers that they have been contacted by a software supplier using the Groupcall name and purporting to be replacing Groupcall Xporter, whilst attempting to gain access to the school Management Information System as part of an alleged 'upgrade'.

 

This is completely false.

 

Please be aware of any suppliers contacting you in an attempt to gain access to your school Management Information Systems. If you do not know who they are or why they need such access, then do not allow access and report the attempt to your Network Manager or Senior Leadership Team so that this can be investigated properly. With the recent increase in 'ransomware' which encrypts your servers and won't decrypt unless you pay a random, it is very important you thoroughly vet and remote access to your school IT systems.

 

Groupcall provides data integration services to move data between schools' Management Information Systems (SIMS, G2, Progresso, etc) and third party software suppliers such as cashless catering, homework software, assessment software etc. To do this, we use Groupcall Xporter which automates the exchange of data to ensure that all of these third party systems remain up-to-date and accurate for schools. Groupcall Xporter automatically updates to provide you with a reliable and secure service, and so being contacted to apply an 'update' manually is a rare case and is usually related to a specific support case you have raised.

 

Groupcall provides these services under strict Data Protection and Information Security Guidelines, which include:

 

- Data Sharing Agreements between the school and the third party software suppliers to allow data sharing.

 

- Exact specifications of what data items can be shared.

 

- Details of the purpose for which the shared data can be used.

 

- Compliance with the Data Protection Act 1998.

 

- Registration with the Information Commissioner's Office.

 

- Why the data sharing is required, how it is going to work and who it's going to be shared with.

 

Groupcall takes data security very seriously, and:

 

- Every one of Groupcall's products is approved on the Government G-Cloud Framework whereby all of our products/solutions have been fully assessed and approved for purchase by public sector organisations.

 

- We are accredited to ISO 27001 - the international standard for Information Security Management.

 

- We are audited annually by an external verifier to ensure that we are protecting your data at all times.

 

Any legitimate supplier will be pleased to have their access checked fully by the school - after all, this is the data on your pupils, their parents and your staff that is at stake. If you wish to verify a caller is from Groupcall, then please ask for the caller's name and hang up, then contact Groupcall from a different phone on 020 8506 6100 and ask to be put back through.

 

Ask questions:

 

- Can they provide similar assurances to those above?

 

- Can you see the agreements they have with whatever third party supplier they are purporting to share your data with?

 

- Do you have a contract with the third party supplier to provide the products to your school?

 

- Can you see the Data Sharing Agreement between them and the software company attempting to access your data?

 

With the forthcoming changes to Data Protection under the General Data Protection Regulation (GDPR) it is a legal requirement for you to have a binding contract with any supplier that you share school data with, no matter what the purpose. Failure to have these contracts in place or allowing access to school data by unauthorised persons could lead to fines of up to 20 million Euros!

 

The data you hold in schools is valuable. It is private. It is personal data about the pupils, parents and staff.

 

Make sure you protect it at all times.

 

If you would like advice or guidance on Data Protection or the changes that are coming with the GDPR, then please feel free to contact us.

 

Kind regards,

 

Steve Baines

Data Protection Officer at Groupcall

[vyperz]

i received the same email - not had any contact from anyone though

[Greg]

Does anyone have any details on the company sending the emails

- Who they are

- Why they want to replace Groupcall

- What they want to replace Groupcall with

[localzuk]

Classroom Monitor seem to have replaced Groupcall Xporter with Wonde recently, but there wasn't anyone claiming to be from Groupcall doing it - they were clear they were from Wonde and Classroom Monitor.

[vikpaw]

@GREED - For your attention

 

Whatever you do, don't 'pay a random'!

 

It's weird and could only be a malicious attempt because if another supplier did this they are bound to be caught and cease being a supplier pretty soon, it would be foolhardy to say the least.

[vikpaw]

Classroom Monitor seem to have replaced Groupcall Xporter with Wonde recently, but there wasn't anyone claiming to be from Groupcall doing it - they were clear they were from Wonde and Classroom Monitor.

I know GCSEpod favour Wonde over Groupcall , but again, they wouldn't purport to be from Groupcall.

 

Unless it's a really, really, really, stupidly setup process running through some agency or call centre being tasked with the changeover.

[limawhiskey]

There seems to be a lot of FUD around this sort of thing.

 

A similar thread popped up on the ANME site a few weeks back. This one mentioned "Wand" (sic), others pointed out the Wonde service is legit, if you use that service for data sharing.

 

It would be great if someone affected could take the time to clarify what's actually going on.

Edited June 20, 2017 by ZeroHour

[vikpaw]

There seems to be a lot of FUD around this sort of thing.

 

A similar thread popped up on the ANME site a few weeks back. This one mentioned "Wand" (sic), others pointed out the Wonde service is legit, if you use that service for data sharing.

 

It would be great if someone affected could take the time to clarify what's actually going on.

 

A groupcall representative is taking a look at this thread and should respond promptly.

Edited June 20, 2017 by ZeroHour

[LemonEntry]

I (Network Manager) received this email. An abridged version was sent to those who have access to Groupcall services, basically saying "If called, take a name and call back on a known good number. Forward suspicious emails to the Helpdesk." The rest reads like marketing fluff.

[vikpaw]

I think most people would be suspicious, I really want to know who it is and where it's happening (i'm assuming it is localised).

The worry is when the person they get through to isn't in IT, is trusting, maybe it's a primary with no IT on the ground, or it's summer and no-one is around....

Troubling, but let's wait for an official word.

[synaesthesia]

I have huge doubts about Wonde. Part of me hopes it's them doing it. They feel like amateurs, look like amateurs and this would prove my point!

Regardless, I've emailed round all my schools advising they ask to verify their ID first or get the schools to call back on a known good number or better still direct straight to us as the IT department. Thanks for the heads up, it's also good for us to push GDPR awareness.

[GREED]

Hello all. Apologies for my tardiness in responding here, thanks for @vikpaw for the heads up.

 

If you are not already aware, I am the Product Manager at Groupcall and usually represent them with anything official on here, as I will do now.

 

We set this out in response to an influx of communications we have has from customers, both direct (using our products) and via schools using only third parties that use Xporter. These rather worrying communications, from rightly concerned schools, have reported at least one company (it may be several) calling to demand access to their MIS servers to replace Xporter with some other tech. Most concerning of all is that these calls claim to be from either third parties (who when challenged separately know nothing about this), from the MIS supplier (who would never ever get involved in this) or from Groupcall ourselves.

 

We are taking this extremely seriously, not least for the reports of people claimed to be Groupcall or representing Groupcall, but also the possibility that these people or the tech involved is not who they claim to be, or what it will be used for.

 

Our advice, in this email as well (pardon the obvious marketing bumpf!), is to be alert, challenge the caller for evidence or verification if needed, ask questions, and if it doesn't seem right then do not allow them to do anything on your systems. I note too that several reports claim these individuals are pushy to get this done, so do stand your ground - if it does turn out to be us after all, our staff all know about this and will not take anything personally!

 

If you have any concerns over any communications you have been sent around this/us/Xporter, from companies you think might not be true or us, or if we have indeed contacted you for some work/support and you are unsure if it is really us, then please get in touch with me directly at [email protected] . (Mods, I'll behave myself and won't be any promotion of products!)

 

Thanks all, and thanks Mods for the freedom to address this.

 

Graham Reed

Product Manager

Groupcall

[vikpaw]

Thanks @GREED and no problem. This is exactly why we want you here, to help the members in these prickly situations.

[vikpaw]

I had the email today for my old place. Bit slow for a company that offers a mailing service. That or they have a gajillion people on their mailing list; I am a V after all!

[GREED]

I had the email today for my old place. Bit slow for a company that offers a mailing service. That or they have a gajillion people on their mailing list; I am a V after all!

 

Us?

 

Yes we do have a quadrillion people on our mailing list, although it seems we also missed @witch as well

 

Not sure why it came so late, they all went out at the same time... The marketing team use HubSpot for these mailing (irony seeing as we are a messaging provider and aggregator!), all I can assume is it was done in batches and a delay via that.

[vikpaw]

Yup, you.

Hubspot - I like that.

Um, maybe you should try Messenger, it's a really cool tool for mass messaging

If it were me, I'd use the SMS option since it's an emergency - there is an unlimited package you know...

[GREED]

If it were me, I'd use the SMS option since it's an emergency - there is an unlimited package you know...

 

Hummmmm.... but we'd have to pay for the SMSs still... it is an emergency... but money...

[vikpaw]

Unlimited means you pay once, then don't worry about it! Hang on - is this a trick to get me to do the sales pitch? Cunning.

Seriously though. Keep us updated, and hopefully no-one has actually fallen for it.

[localzuk]

I'm still a little worried about this being FUD to be honest - the opening salvo of the email in the original post states, point blank, that someone offering an upgrade is false. Even with the explanation.

 

If a company is actively misusing another company's name then we should be told the name of the culprit, and potentially an example, so that we can steer well clear.

 

Otherwise, to me it is reading as GroupCall trying to throw shade at a competitor who are taking some of their market share.

[mikemcsharry]

I received the email as I'm named contact for a school.

Thanks for the confirmation in this forum that this is real.

But..

Please can @grazreed ask Steve Baines to refrain from the scaremongering.

Yes, I'm not a lawyer etc. etc., but any need to chuck in the 20 million euros line??

 

As far as I can see the biggest Data Protection fine has been about 6million euros, levied on a UK company by an Italian court.

It really is worth reading the very, very naughty things you have to do to get beaten up so badly.

Italian DPA Imposes Largest Ever Fine Imposed by a European Data Protection Authority: UK Payments Company Found to Have Breached Consent and Other Rules - Lexology

 

...

"Failure to have these contracts in place or allowing access to school data by unauthorised persons could lead to fines of up to 20 million Euros!"A

[GREED]

I'm still a little worried about this being FUD to be honest - the opening salvo of the email in the original post states, point blank, that someone offering an upgrade is false. Even with the explanation.

 

If a company is actively misusing another company's name then we should be told the name of the culprit, and potentially an example, so that we can steer well clear.

 

Otherwise, to me it is reading as GroupCall trying to throw shade at a competitor who are taking some of their market share.

 

It is what it is Tony - many seem to be heeding the advice, feel free not to

 

I'll point out that the reports of companies pretending to be us, or a third party, or an MIS, were reported here first before we released this statement. You seem to be the only one feeling like we are trying to protect our market share - if only it were that simple. What said companies are doing is at best cheating to get their products installed - that is cheating schools, at worst are installing software for purposes that they are not stating, we may all find this out today, or sometime in the future.

 

I/we are not going to open up the floor to any company denying involvement by naming here - we are not 100% sure ourselves who they are, which if you read previously I have asked for any evidence of this to be submitted to me. If it is proven, we can decide to take action. All of this is for Groupcall to deal with - this message was a reminder to be vigilant against this sort of thing, and to alert the school community of what we have seen - which I think everyone will agree is a positive thing.

 

To be honest, there have been names mentioned in this thread that will help you to your answer.

 

Finally, again, this is not about showing shade on competitors, there are competitors out there for the Xporter market, we have a civil relationship with most of them, they have good products just like us. We welcome competition as it forces us to make our own products better, and as always, suggest you and third parties using Xporter-type products to review the market and pick the best one for you. What this is doing is tarnishing our name and our partners names by pretending to be us or them.

 

As I say, take the warning for what it is, a service, or don't

[GREED]

Please can @grazreed ask Steve Baines to refrain from the scaremongering.

 

 

I'll pass the feedback along Mike, I was not in control of that message content (unfortunately) - I agree it is a bit... verbose...

[Network_Boy]

Classroom Monitor seem to have replaced Groupcall Xporter with Wonde recently, but there wasn't anyone claiming to be from Groupcall doing it - they were clear they were from Wonde and Classroom Monitor.

 

Can anyone from Classroom monitor confirm that they have indeed replaced groupcall with wonde?

[localzuk]

It is what it is Tony - many seem to be heeding the advice, feel free not to

I'll point out that the reports of companies pretending to be us, or a third party, or an MIS, were reported here first before we released this statement. You seem to be the only one feeling like we are trying to protect our market share - if only it were that simple. What said companies are doing is at best cheating to get their products installed - that is cheating schools, at worst are installing software for purposes that they are not stating, we may all find this out today, or sometime in the future.

I/we are not going to open up the floor to any company denying involvement by naming here - we are not 100% sure ourselves who they are, which if you read previously I have asked for any evidence of this to be submitted to me. If it is proven, we can decide to take action. All of this is for Groupcall to deal with - this message was a reminder to be vigilant against this sort of thing, and to alert the school community of what we have seen - which I think everyone will agree is a positive thing.

To be honest, there have been names mentioned in this thread that will help you to your answer.

Finally, again, this is not about showing shade on competitors, there are competitors out there for the Xporter market, we have a civil relationship with most of them, they have good products just like us. We welcome competition as it forces us to make our own products better, and as always, suggest you and third parties using Xporter-type products to review the market and pick the best one for you. What this is doing is tarnishing our name and our partners names by pretending to be us or them.

As I say, take the warning for what it is, a service, or don't

If this is just about giving advice, then whoever wrote that warning email really needs to refrain from the overt marketing and over the top scare tactics.

 

If, as you say, you aren't 100% sure who is doing this, and don't have the evidence yet of it, then it is even more necessary to be extremely careful with your advice. You know how school management are. An email like that will send many into a tailspin! Going in to detail about fines and the like is not necessary, and is what I refer to as scaremongering/FUD.

 

Can anyone from Classroom monitor confirm that they have indeed replaced groupcall with wonde?

 

Yup. Classroom Monitor confirmed that they are migrating everyone from GroupCall Xporter over to Wonde.

Edited June 22, 2017 by localzuk

[synaesthesia]

Can anyone from Classroom monitor confirm that they have indeed replaced groupcall with wonde?

 

They absolutely have. A colleague and myself have been dealing with them regarding concerns over Wonde, and they confirmed to us they are no longer working with Groupcall, much to our annoyance. Groupcall have always been fantastic both as a service and their support and we saw no reason they would otherwise change.