Meldrew Posted July 17, 2018 Posted July 17, 2018 Hmm. I ran the v4 script here and getting no bad data. Sounds too good to be true... Meldrew
DJ-1701 Posted July 17, 2018 Posted July 17, 2018 Hmm. I ran the v4 script here and getting no bad data. Sounds too good to be true... Meldrew 3 records had issues here with the script, so the script does do something.
MYK-IT Posted July 17, 2018 Posted July 17, 2018 Just a suggestion, any chance this thread could become a sticky? As thanks to @titch original post, (and ongoing updates from many other Edugeekers - thanks) this has been invaluable as we had no awareness / communication from our own LEA SIMS Support Team regarding the scope of this issue, until I contacted them. The script has unfortunately highlighted potential records that may be affected, therefore I am sure that many, many other schools will be affected too. 2
djrscally Posted July 17, 2018 Posted July 17, 2018 So with this occurring, surely all Capita SIMS schools are legally obliged to report a possible breach to the ICO? (as obviously should Capita) Capita say not their responsibility to report: We have been asked several times if we (Capita ESS) have reported this to the ICO, this is not Capita ESS’s responsibility as data processor and as the data controller it is the customers responsibility to report any data breaches to the ICO. Extensive guidance is available on the ICO website ( https://ico.org.uk/for-organisations/report-a-breach/) on data breaches and customers should review this thoroughly before taking any action.
synaesthesia Posted July 17, 2018 Posted July 17, 2018 Indeed, but as mentioned before it would be nice for them to have some involvement. "We've caused a mess, you're getting in trouble for it" seems nasty. Wonder if anyone's told TheRegister about it yet, they love a Crapita story
siuko Posted July 17, 2018 Posted July 17, 2018 I have run the V4 script and it only shows 2 issues Can I take it that is all that is affected? Is there anything else I should be doing or should I wait for the 24157 patch to confirm?
djrscally Posted July 17, 2018 Posted July 17, 2018 Indeed, but as mentioned before it would be nice for them to have some involvement. "We've caused a mess, you're getting in trouble for it" seems nasty. Wonder if anyone's told TheRegister about it yet, they love a Crapita story I apologise! For some reason I only read Page 1 before replying, that was daft.
MYK-IT Posted July 17, 2018 Posted July 17, 2018 (edited) I have run the V4 script and it only shows 2 issues Can I take it that is all that is affected? Is there anything else I should be doing or should I wait for the 24157 patch to confirm? Patch 24157 adds the script to “database diagnostics” within SIMS itself, therefore making it easier for schools to run (e.g. by a SIMS user) without the need to access via DbDiagnose (e.g. IT Tech access level) - same thing / results as v4 script Edited July 17, 2018 by MYK-IT
tech-man Posted July 17, 2018 Posted July 17, 2018 I wonder how confident they are the V4 script will identify all issues... I believe our Data Manager has done some exports / lookups / comparisons and identified an issue not flagged by the script.
MYK-IT Posted July 17, 2018 Posted July 17, 2018 I wonder how confident they are the V4 script will identify all issues... I believe our Data Manager has done some exports / lookups / comparisons and identified an issue not flagged by the script. I am sure that the results of the V4 script is just a starting point (and potentially 'tip of the iceberg') as we too are currently processing through the v4 script results, as well as cross-referencing other records / archived backups prior to SIMS Autumn 2017 update etc. for validation / checks etc.
jdsa Posted July 17, 2018 Posted July 17, 2018 Trying to run the DBDiagnose tool but I'm getting an "Illegal characters in path" error, any ideas? Using the V4 sql file, checked the server names etc are correct...
Meldrew Posted July 17, 2018 Posted July 17, 2018 Trying to run the DBDiagnose tool but I'm getting an "Illegal characters in path" error, any ideas? Using the V4 sql file, checked the server names etc are correct... Is you sql file local to where you're running dbDiagnose? If not I'd copy it so its on the local drive.
theeggmaster Posted July 17, 2018 Posted July 17, 2018 Just for the record, we applied patch 24068 and imported some CTF files. One of our families has the father and the grandfather with exactly the same name. The father had only an email address in his CTF record, and the grandfather only had two telephone numbers. When SIMS matched them together, it created a single contact with two telephone numbers and an email address, but managed to put that single contact in for both the father and the grandfather. If you tried to edit the grandfather, SIMS wouldn't save, would crash and the error said that it couldn't save a duplicate ID (as it was trying to save the merged contact twice). Reported it to Capita and they have said that it is an isolated incident, even though it is clearly going through the matching process. 1
Meldrew Posted July 17, 2018 Posted July 17, 2018 (edited) I don't know if this helps anyone (and if you spot problems with my logic, do let me know), but in order to check what dbDiagnose reported, I ran a SIMS report showing all contacts of all students on roll to Excel. I then checked when I installed the Autumn release of SIMS (10th Dec 2017 for me). I then looked in SIMS to find the next admission number that was admitted after this date, call it 10,000. Going back to Excel, I highlighted all admission numbers higher than 10,000 and then used a countif in excel to look at how many instances there are of every parent name. Cross referencing these higher than 10,000 admission numbers with the number of instances of parent's name gave us 1 result. This was for a family as we had 3 students join at once, so not an issue. Meldrew Edit: accidentally put 10th Dec 2018 rather than 2017. Edited July 17, 2018 by Meldrew 1
hiphopamus Posted July 17, 2018 Posted July 17, 2018 I don't know if this helps anyone (and if you spot problems with my logic, do let me know), but in order to check what dbDiagnose reported, I ran a SIMS report showing all contacts of all students on roll to Excel. I then checked when I installed the Autumn release of SIMS (10th Dec 2017 for me). I then looked in SIMS to find the next admission number that was admitted after this date, call it 10,000. Going back to Excel, I highlighted all admission numbers higher than 10,000 and then used a countif in excel to look at how many instances there are of every parent name. Cross referencing these higher than 10,000 admission numbers with the number of instances of parent's name gave us 1 result. This was for a family as we had 3 students join at once, so not an issue. Meldrew Edit: accidentally put 10th Dec 2018 rather than 2017. Does this take into account the issue where the preadmission child could take on the existing contact record resulting in only one instance of the contact?
jdsa Posted July 17, 2018 Posted July 17, 2018 Is you sql file local to where you're running dbDiagnose? If not I'd copy it so its on the local drive. Thanks for the suggestion but copying it to be local didn't help.
bigdannyb79 Posted July 17, 2018 Posted July 17, 2018 Don't know why people are getting all hot and bothered about this. Its capita SIMS - please apply the patch and forget about the problems its caused, all is well, please continue to use your market leading product. And remember to renew indefinitely because this is the only option for you as a school. . . The error and timescales for communication and resolution are laughable but the general attitude to the severity and scale of the issue sums what they think of their customers for me. We've spoken to support about this and was discussed as if its a local issue and patch was applied but no correction has taken place so we have a live and current data protection issue and 'enhanced' capita support told us the patch fixed it. poor just doesn't cover it. 1
Meldrew Posted July 17, 2018 Posted July 17, 2018 Does this take into account the issue where the preadmission child could take on the existing contact record resulting in only one instance of the contact? Fair point. Wouldn't have thought so as the on-roll report wouldn't pick up pre-admissions.
Esteban_Child_of_the_Sun Posted July 17, 2018 Posted July 17, 2018 Trying to run the DBDiagnose tool but I'm getting an "Illegal characters in path" error, any ideas? Using the V4 sql file, checked the server names etc are correct... that error is helpfully telling you it can't find the signature file. There should be 2 files, the SQL script and another with almost the same name, except it has an additional extension of .signature 1
Data2 Posted July 17, 2018 Posted July 17, 2018 Does anyone know the effect on hosted SIMS and if the patch has already been applied?
synaesthesia Posted July 17, 2018 Posted July 17, 2018 Well it's now hit El Reg, linking to this forum page/post. https://www.theregister.co.uk/2018/07/17/crapita_strikes_again_software_bug_in_schools_contact_book_risks_huge_data_breach/ ICO investigating apparently with advice that schools should be sending no information out until those contacts are verified which should be common sense. 2
GREED Posted July 17, 2018 Posted July 17, 2018 (edited) Well it's now hit El Reg, linking to this forum page/post. https://www.theregister.co.uk/2018/07/17/crapita_strikes_again_software_bug_in_schools_contact_book_risks_huge_data_breach/ ICO investigating apparently with advice that schools should be sending no information out until those contacts are verified which should be common sense. Questionable source of information in there "According to a user on an education technology forum" - very questionable source is said forum :D Edited July 17, 2018 by GREED
djrscally Posted July 17, 2018 Posted July 17, 2018 Questionable source of information in there "According to a user on an education technology forum" - very questionable source :D Quoting hearsay no less! 1
Popular Post john Posted July 17, 2018 Popular Post Posted July 17, 2018 Just a suggestion, any chance this thread could become a sticky? As thanks to @titch original post, (and ongoing updates from many other Edugeekers - thanks) this has been invaluable as we had no awareness / communication from our own LEA SIMS Support Team regarding the scope of this issue, until I contacted them. The script has unfortunately highlighted potential records that may be affected, therefore I am sure that many, many other schools will be affected too. Glue used and now stuck For future note please report post and in the reason to report put could it be sticky'd as we don't always have time to read every single post in every thread so may have missed this had I not been monitoring this thread 5
GrumbleDook Posted July 17, 2018 Posted July 17, 2018 Quoting hearsay no less! Better than quoting Hear'say!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now