ClassCharts GDPR security issue

[PotNoodleTech]

I'm leaving the my DPO and the LEA Legal /DPO team deal with it now.

 

Adding classcharts / TES to the list of companies that don't take Data Protection seriously and are not trustworthy with our data. Whether we drop classcharts is another matter through, one higher than my pay grade! (not hard..)

[PotNoodleTech]

https://www.cornwalllive.com/news/cornwall-news/classcharts-login-problems-due-national-9051705

[SKZ]

Are they at Bett to get clobbered.!? [emoji23]

 

https://www.linkedin.com/posts/tesglobal_bett2024-education-activity-7156293966538162176-i4A_/

Edited January 25, 2024 by SKZ

[enjay]

The daft thing is, if they report it to ICO, things will blow over quickly, especially given how short a period the issue was live and how quickly resolved.

 

The ClassCharts app on my phone has just updated too, so they're clearly fixing things in the background, and quickly.

[Iain.Faulkner]

We went and spoke to them yesterday.

 

We were asked by a marketing guy to do a bit of a video about the TES Products we use and how they've positively impacted our schools. We declined due to the incident with Classcharts this week. The two guys we spoke to were both giving the same message though "we're not allowed to discuss the incident with classcharts".

[Aprice]

We went and spoke to them yesterday.

 

We were asked by a marketing guy to do a bit of a video about the TES Products we use and how they've positively impacted our schools. We declined due to the incident with Classcharts this week. The two guys we spoke to were both giving the same message though "we're not allowed to discuss the incident with classcharts".

 

Hmmmm....

[WannabrewUK]

Is it just me, or have their support department stopped responding to all support requests?

 

I contacted them on Tuesday morning about performance issues and they still haven't responded. I've sent an email every morning asking for an update and have hand nothing at all.

[ABR82]

We were asked by a marketing guy to do a bit of a video about the TES Products we use and how they've positively impacted our schools. We declined due to the incident with Classcharts this week. The two guys we spoke to were both giving the same message though "we're not allowed to discuss the incident with classcharts".

 

Thank you. Hopefully all schools respond this way. We're not prepared to vouch for you unless you can fix how you act.

 

Companies need to be told in no uncertain terms that the way in which they behave matters, never mind what they think they can legally justify or get away with (See also Bromcom's lawyers leaching public money from the education budget at every opportunity).

 

It all leaves a bad taste in the mouth - fundamentally the question is "Do I want to get into a paying relationship with a company that behaves like this when there are similarly capable and priced competitors who don't."

[PotNoodleTech]

The only way classcharts are going to understand the ramifications of their poor decisions are if schools actually drop the contracts and leave them.

 

All the blah blah on the forums and in the newspapers won't make any difference really as all the money is still coming in.

[3s-gtech]

Update today, our DPO team have reported.

"EduKey have reported the ClassCharts incident to the ICO."

 

This information was received from the ICO themselves, so it is at least with the right people and has been given an appropriate response.

[WannabrewUK]

Update today, our DPO team have reported.

"EduKey have reported the ClassCharts incident to the ICO."

 

This information was received from the ICO themselves, so it is at least with the right people and has been given an appropriate response.

 

That's odd, our DPO was told the opposite. Have you got a copy of the email that you could share?

 

Thanks

[3s-gtech]

Have you got a copy of the email that you could share?

Thanks

No sorry, just the communication back from our DP team as above. I have seen on here that others have confirmed this also.

[howartp]

I have seen on here that others have confirmed this also.

I've not seen any posts that say this; all the posts i've seen say/show that ClassCharts are NOT reporting themselves as the non-issue was not reportable?

[3s-gtech]

I've not seen any posts that say this; all the posts i've seen say/show that ClassCharts are NOT reporting themselves as the non-issue was not reportable?

All I have in front of me is the communication from our team - "[we've] been informed by the ICO that EduKey reported the ClassCharts incident to the ICO."

Can't find the other post now. It will be worth making your own inquiries to the ICO also.

[enjay]

I've not seen any posts that say this; all the posts i've seen say/show that ClassCharts are NOT reporting themselves as the non-issue was not reportable?

 

I know of one school who were told by ClassCharts that the school needs to report it, because as the data controller it's the school's breach...

[Brax]

This is now covered on schoolsweek and we are mentioned, link to full article here : https://schoolsweek.co.uk/reports-of-data-breach-on-class-charts-platform/

 

The information watchdog is investigating reports of a data breach on the Class Charts behaviour management platform, which is used by tens of thousands of teachers.Some parents logging on to Class Charts last week were reportedly shown data relating to other children.

The Information Commissioner’s Office told Schools Week it had “received a data breach report in relation to Class Charts and are assessing the information provided.

“Anyone who is concerned about how their data has been handled can get in touch with the ICO or check our website for advice and support,” said an ICO spokesperson.

Class Charts is used by more than 180,000 teachers, its website states. The company says it can “save teachers time and reduce workload with our data rich seating plans” and “improve pupil behaviour with our fast and effective behaviour management”.

Class Charts, owned by Tes Global Limited, did not respond to requests for comment.

Posts on school IT professionals forum Edugeek claimed some parents logging on to the system were shown information relating to other people’s children. A thread on the issue has more than 100 posts.

One post stated that “we had a parent report seeing totally different pupils from totally different schools”.

Another said they had “two other schools ring us to say their parents had seen data of our students/pupils as they recognised the school logo and contacted us to make us aware”.

A banner on the Class Charts platform, shared on Edugeek, initially stated that “we regret to inform you that a data breach has occurred on Class Charts”.

Edited February 3, 2024 by Brax

[Ditto]

It's not clear who reported. If it was TES or subsidiaries, the headline needs 'kicking and screaming' added. If it was as a result of schools and/or parents, well I commented on this earlier. Just be honest with the data owners, it's all we ask. The bulge under carpet at times gets to the point everyone trips over it!

[Dukey89]

Already looking to move away from CC anyway before this. They clearly take on too many new schools before their back end infrastructure is ready to cope with the new load. Every start of terms its the same, unusable most days between 8:30 and 9:30. We had teachers logging in during this "breach"and seeing another school too,not just parent side, clearly all data isnt siphoned off seperately.

[Dukey89]

Literally as I pressed post then: A message over the radio from attendance to pastoral "sorry, class charts is down" Shambles

[PotNoodleTech]

Yep still struggling to use it in the mornings here too. I guess whatever performance improvements caused the data loss have been rolled back.

[jc1]

Explicit comments on Billingham school app after alleged hack - BBC News

[enjay]

Explicit comments on Billingham school app after alleged hack - BBC News

 

I wonder if all the comments were from the same staff member. If so, I suspect someone got hold of their password or phone.

[Brax]

Explicit comments on Billingham school app after alleged hack - BBC News

"Experts are urging schools to keep up with data security requirements and properly vet the platforms they use."

I don't even know what to say to that.

[Primus]

"Experts are urging schools to keep up with data security requirements and properly vet the platforms they use."

I don't even know what to say to that.

 

You'd be shocked at how many schools have a free for all when it comes to 3rd party apps - sending staff and student data here, there and everywhere without any proper overview.

 

You'd also be shocked at how many schools still don't use MFA - I know of one large Catholic MAT in the NE who don't have forced MFA for staff on M365.

[Brax]

You'd be shocked at how many schools have a free for all when it comes to 3rd party apps - sending staff and student data here, there and everywhere without any proper overview.

 

You'd also be shocked at how many schools still don't use MFA - I know of one large Catholic MAT in the NE who don't have forced MFA for staff on M365.

Yeah fair. And with everything moving to cloud based services it's only going to get more difficult with managing these 3rd party apps.