mthomas08 Posted January 22, 2020 Posted January 22, 2020 Surprised these companies were quick to say phishing. I thought it was quite obvious an error on Capitas part, especially those that said they contacted Capita direct. (agreed that EduLinkOne shouldn't be put in the same sentence as SIMs - EduLink one consistently works and was deployed very smoothly for us and I can't praise it enough).
witch Posted January 22, 2020 Posted January 22, 2020 Did anyone spot that in the list of email addresses - well mine anyway, was a certain Tony the Tiger @GrumbleDook Addressed to him in a previous job I believe 2
jthompson Posted January 22, 2020 Posted January 22, 2020 Surprised these companies were quick to say phishing. Indeed. That in itself is concerning.
synaesthesia Posted January 22, 2020 Posted January 22, 2020 Did anyone spot that in the list of email addresses - well mine anyway, was a certain Tony the Tiger @GrumbleDook Addressed to him in a previous job I believe I did spot that on one of the emails I saw
DJ-1701 Posted January 22, 2020 Posted January 22, 2020 (edited) Did anyone spot that in the list of email addresses - well mine anyway, was a certain Tony the Tiger @GrumbleDook Addressed to him in a previous job I believe Indeed. That in itself is concerning. I did spot that on one of the emails I saw My line manager also got an e-mail, even though the schools has longer been covered by Capita support for SIMS for a couple of years. So that would suggest holding mass information when it's no longer relevant and not clearing out old details which they should be doing. Edited January 22, 2020 by DJ-1701
DODICT Posted January 22, 2020 Posted January 22, 2020 Surprised these companies were quick to say phishing. I thought it was quite obvious an error on Capitas part, especially those that said they contacted Capita direct. (agreed that EduLinkOne shouldn't be put in the same sentence as SIMs - EduLink one consistently works and was deployed very smoothly for us and I can't praise it enough). My point is this is a company that has let its customers down time and time again and not invested in their product but still demands a premium price tag. I find it frustrating customers continue to pay their dues to capita and then pay more to augment the flawed solution. Capita does very little and they get paid in full its quite impressive. The poorer their product is the more partner income they get from customers seemingly happy to top up their MIS at their cost. Other companies who are investing and developing decent solutions (of which Edulink seem to be one) are making strides forward with a fraction of the income SIMs generates on an annual basis. So for that reason I get frustrated when get another example of their general ineptitude not hitting their bottom line in the way it should and would in pretty much any other market. The monopoly created and supported by LA's continues to live on and our schools are worse for it. Would love Edulink to just create their own database and bring a fully fledged MIS to the market but at present their are helping SIMS persist with a significant market share and in my opinion thats a bad thing and not something their product or customer service deserves.
DJ-1701 Posted January 22, 2020 Posted January 22, 2020 Surprised these companies were quick to say phishing. I thought it was quite obvious an error on Capitas part, especially those that said they contacted Capita direct. If it's taking you to a website that Capita has never used with you before, and the certificate on that website is just a Let's Encrypt one with no company detail visible, wouldn't first assessment be possible phishing attempt. Makes sense to act first on worst case scenario until you can prove otherwise... didn't help that some information on who is sites was redacted although others did show Capita.
jthompson Posted January 22, 2020 Posted January 22, 2020 Capita have recently emailed MyAccount users advising them of the new Software Support site and how to set up new passwords, etc. so it wasn't quite fair to say that it's the first we've seen of that site.
synaesthesia Posted January 22, 2020 Posted January 22, 2020 If it's taking you to a website that Capita has never used with you before, and the certificate on that website is just a Let's Encrypt one with no company detail visible, wouldn't first assessment be possible phishing attempt. Makes sense to act first on worst case scenario until you can prove otherwise... didn't help that some information on who is sites was redacted although others did show Capita. Took me 3 minutes to prove it was legitmate. yet large LEA level providers still assumed the worse. I despair. 4
IrritableTech Posted January 22, 2020 Posted January 22, 2020 My line manager also got an e-mail, even though the schools has longer been covered by Capita support for SIMS for a couple of years. So that would suggest holding mass information when it's no longer relevant and not clearing out old details which they should be doing. These details are taken from a self registration support desk - not school official contact information as I understand it. I self registered for a yahoo email address possibly 15 years ago (or more). I'd expect it will still be there today, because I haven't told them I don't want to use it again.
DJ-1701 Posted January 22, 2020 Posted January 22, 2020 Took me 3 minutes to prove it was legitmate. yet large LEA level providers still assumed the worse. I despair. Well better to be more protective than less, especially since there were some users who reported getting directed to other websites such as Google and other who said the site didn't accept their Capita passwords. These details are taken from a self registration support desk - not school official contact information as I understand it. I self registered for a yahoo email address possibly 15 years ago (or more). I'd expect it will still be there today, because I haven't told them I don't want to use it again. I wonder if they have a service to remove the address... yet shouldn't they be clearing any inactive accounts anyway?
mthomas08 Posted January 22, 2020 Posted January 22, 2020 My point is this is a company that has let its customers down time and time again and not invested in their product but still demands a premium price tag. I find it frustrating customers continue to pay their dues to capita and then pay more to augment the flawed solution. Capita does very little and they get paid in full its quite impressive. The poorer their product is the more partner income they get from customers seemingly happy to top up their MIS at their cost. Other companies who are investing and developing decent solutions (of which Edulink seem to be one) are making strides forward with a fraction of the income SIMs generates on an annual basis. So for that reason I get frustrated when get another example of their general ineptitude not hitting their bottom line in the way it should and would in pretty much any other market. The monopoly created and supported by LA's continues to live on and our schools are worse for it. Would love Edulink to just create their own database and bring a fully fledged MIS to the market but at present their are helping SIMS persist with a significant market share and in my opinion thats a bad thing and not something their product or customer service deserves. Oh I agreed, although not on the part of EduLinkOne pushing the SIMs market. They've simple picked a popular.. I mean perhaps... just a well known MIS to link to (like they all do). I'd be surprised if there was plenty of schools signing up to SIMs just because of EduLink. We just signed up to the renewal but it is on my list to discuss with my LM. It's a big thing in changing MIS and that's the problem. Teachers tell everyone that its great, but they are not the ones doing the reports or deal with the complex tasks. Even our attendance person that suffers these stupid memory errors can still be positive.. 1
PotNoodleTech Posted January 22, 2020 Posted January 22, 2020 Yep, we got it, reported it to the LEA sims team and then reported it to Capita as a data breech. Looked like a bug in their helpdesk software to me! 2
Chunky Posted January 22, 2020 Posted January 22, 2020 I got that email too. Not happy. Now 99 other geeks have my email. How much geekage can someone have? 1
MayfieldIT Posted January 22, 2020 Posted January 22, 2020 Ha Ha, but actually I reported it to Capita Support and am now watching the tumbleweed. Where is their response? My email along with dozens of others should not have been emailed out in clear sight. I expect this to have been reported to the Data Information Commisioner.
MayfieldIT Posted January 22, 2020 Posted January 22, 2020 I thought under GDPR Capita (and others) had to re-ask you to confirm that you wanted to continue, not by default continue unles you tell them otherwise?
willtech Posted January 22, 2020 Posted January 22, 2020 (edited) Ha Ha, but actually I reported it to Capita Support and am now watching the tumbleweed. Where is their response? My email along with dozens of others should not have been emailed out in clear sight. I expect this to have been reported to the Data Information Commisioner. Not from what the register has found at the moment: https://www.theregister.co.uk/2020/01/22/capita_education_services_email_spaff/ The Register has contacted Capita for its take on things. A spokesperson told us: We are aware of a technical issue which resulted in a number of our software clients receiving a limited number of other clients' email addresses. The impact on the affected clients is contained. We regard the security of our client's data as very important and we have taken immediate steps to address this issue. We also spoke to the ICO, which told us the matter has yet to be reported to it. Capita has 72 hours from acknowledging the breach to do so. Edited January 22, 2020 by willtech
jthompson Posted January 22, 2020 Posted January 22, 2020 They certainly have to formally log it internally as a breach, but I can't remember what the criteria are for reporting to the ICO.
Chunky Posted January 22, 2020 Posted January 22, 2020 The worst thing about this? Capita increasing support costs & product costs to cover the fines they'll probably receive ..... (They have to pay for it somehow, and I don't think they have a savings account called "GDPR f&%k Ups" )
jthompson Posted January 22, 2020 Posted January 22, 2020 It's not going to be that big a fine is it?! If anything. It's not like they were letting, oh I dunno, large betting companies scrape personal details of all children for a prolonged period of time (*cough, DfE, *cough).
DrCheese Posted January 22, 2020 Posted January 22, 2020 I await the mandatory dialog box that will pop up the first time someone opens SIMS in the not to distant future that attempts to force the school to accept blame for any data leaks caused by Capita, just like last time. Also like last time I will enjoy watching the ICO slap them down for trying
willtech Posted January 22, 2020 Posted January 22, 2020 https://www.theregister.co.uk/2020/01/22/capita_education_services_email_spaff/ An ICO spokesperson told The Register: "Capita has reported an incident to us and we will assess the information provided."[/Quote]
Zammo Posted January 23, 2020 Posted January 23, 2020 I highly doubt they will get a fine The ICO ask the question [h=2]How likely is it that the breach will result in a risk to individuals?[/h]
synaesthesia Posted January 24, 2020 Posted January 24, 2020 I highly doubt they will get a fine The ICO ask the question [h=2]How likely is it that the breach will result in a risk to individuals?[/h] "Aha, so Joe Bloggs, the man with an injunction against me because reasons, is working at Smith School in Smithtown. Now I can continue to maim him with the view to do more". Just because they're staff, doesn't mean they're any less vulnerable in some cases than students who have similar reasons to not be named in public. 2
3s-gtech Posted January 24, 2020 Posted January 24, 2020 From what I’ve read of ICO fine outcomes, they’ve got the bark of a Doberman when it comes to threats, and the bite of an elderly, toothless Labrador when it comes to actually seeing it through. I’d imagine there’ll be no fine, and simply some highly useful ‘advice given’.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now