ClassCharts GDPR security issue

[howartp]

Hi everyone.

 

Please be advised: ClassCharts are aware of an issue where parents are seeing data from students at other schools - they are advising you to disable parent and pupil access to ClassCharts whilst they investigate.

[TechMonkey]

Is this published anywhere, sent out or just being told to those who phone up?

 

EDIT: Also, do we know more? Is it a case of entering a random string and finding info (URL manipulation) or actual data being published to the wrong parents?

Edited January 22, 2024 by TechMonkey

[howartp]

There's a message on their phone system saying they're aware of an issue; I continued past it to speak to someone and they told me this was the advice they were giving schools whilst they worked on it.

 

A communication will apparently come out to tell us we can turn it back on again.

 

- - - Updated - - -

 

(One of our parents sent us a screenshot showing two other pupils from two other schools, which is how I knew about it and rung up to report it)

[mattysmith80]

I just called them and they are currently investigating... when I said how will I know when its resolved, do you have a status page etc... he said they didnt have a service and we will probably receive an email.

[howartp]

On desktop, parent at our school (School 1) is seeing Student 2 from School 2 on the left menu and the homework/behaviour totals etc, and Student 3 from School 3's announcements at the bottom.

 

So not just one wrong student, in one wrong school!

[TechMonkey]

Are you a MAT/Trust and the School 1,2 & 3 in your group or are the schools completely separate?

[howartp]

Nope, we're single school academy - never heard of either schools 2/3.

 

Peter

[Iain.Faulkner]

Just spoken to Classcharts first line support and they are saying that the issue is showing as resolved in their system. They are now doing further investigation. He said he expected an email to go out to schools explaining the situation.

[TechMonkey]

Just realised, their advice on locking out parents is utterly useless as all that does is stop our parents seeing any information, doesn't stop our pupils data being shared!

[howartp]

Just realised, their advice on locking out parents is utterly useless as all that does is stop our parents seeing any information, doesn't stop our pupils data being shared!

Advice is to lock out parents and pupils; how do you see data being shared if neither of these can log in?

 

- - - Updated - - -

 

Apologies - yes, you mean other schools will still see your data if THEY haven't taken the same actions.

[mattysmith80]

this is one of those things where you think, how on earth does this actually happen, surely everyone's data is siloed away from each other... but clearly not.... Classcharts is a pretty reputable company and it always worries me when we have staff beavering away signing up to all sorts putting personal data in and not stopping to think about the data.. and then going "oh what you mean a Privacy impact assessment" I have already signed up for 5 years

[WannabrewUK]

Classcharts have told me it was resolved around 11.10 this morning, but they don't know the full impact of who was affected. They said they'll be putting out a statement once they know what happened and to who.

[lmgtfy]

We've had the same and have heard reports from other schools in our trust. Unbelievable that they've not pressed a central button to disable everyone. Telling schools to individually disable access is not enough. How long have they known about the issue and have chosen to ignore it. Also a company without a status page in this day and age is madness. Ok rant over for a minute.

[PotNoodleTech]

Yes can confirm we had a parent report seeing totally different pupils from totally different schools.

 

Rung classcharts and they confirmed a 15 minute long technical issue that caused this and that it is likely to be considered a data breech. They asked me to email in the fact that we are reporting this and they said they will be drafting an email to all schools affected.

 

Considering this a possible data breech (assuming that if our parent could see other school data that some other parents in the UK could have seen some of our pupil data??)

 

not good!

[lmgtfy]

Be interesting if we all put the times here as I feel 15 minute is somewhat optimistic

 

10.53am is the time on the reported screenshot to us.

Edited January 22, 2024 by lmgtfy

[howartp]

10.55 here.

[3s-gtech]

Go cloud, they said.

 

It'll be better, they said.

[CHiLL]

Go cloud, they said.

 

It'll be better, they said.

[ATTACH=CONFIG]70674[/ATTACH]

.

[3s-gtech]

We'll need to let parents know pretty soon. So, a statement today would be good! When you have vulnerable students or those with court orders etc, who knows what has been disclosed :E

[synaesthesia]

Why on earth are they saying YOU need to lock people out? On discovery of such a breach THEY should be shutting it all down until resolved...

 

https://ico.org.uk/

[ep260766]

I've just had confirmation via telephone that the issue is resolved and to re-enable communication settings in ClassCharts. Parents will need to log out and back into the app to refresh the data.

[WShippin]

"We regret to inform you that a data breach has occurred on Class Charts; rest assured, we are actively addressing the issue, you do not need to take any actions but we will be in contact with affected users to ensure their data security." is now shown on a banner on the Homepage (after you login)

[Iain.Faulkner]

Speaking with our named contact for Classcharts (a Deputy head at one school), she has received no email from classcharts advising of a problem with guidance on what to do, and had no email either to confirm that the problem is resolved and we can allow users back on. Having spoken with classcharts, they aren't intending on sending anything out to schools until they have completed their internal investigation.

[TechMonkey]

How many bets nothing appears until next week? Would surely be a coincidence.

[mattysmith80]

Classcharts is our data processor and must inform their clients (the data controllers), without delay, of any data breach. These arrangements should be described in the contract our schools have with them. We in turn have a statutory responsibility to inform the ICO of the data breach within 72 hours.