ICO poised to fine Advanced Computer Software Group for NHS breach

[Roberto]

Some interesting stuff here I think, one to show your SLT if they still don’t take precautions around pupils’ data seriously.

 

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/08/provisional-decision-to-impose-6m-fine-on-software-provider-following-2022-ransomware-attack/

The provisional decision to issue a fine relates to a ransomware incident in August 2022, where we have provisionally found that hackers initially accessed a number of Advanced’s health and care systems via a customer account that did not have multi-factor authentication. ​(Emphasis mine)​

[Jobos]

I’ve been saying to the HT we need and should be using MFA for 365 but keep getting pushed back with the excuse it’s policy staff should not be using mobiles in class. The school is broke with no money for tokens and no money to upgrade 365 licenses. Pretty much between a rock and a hard place.

[CTIDTech]

Good read and well worth noting! We MFA or 2FA all users (students as well) to access all their digital resources - Students use an image/PIn depending on age, Teachers use a PIN if they refuse refuse to use their phone, and everyone else authenticators. Took some training initially, but all on board now for everything! Much safer and another tick in the box!

[glen_j]

I’ve been saying to the HT we need and should be using MFA for 365 but keep getting pushed back with the excuse it’s policy staff should not be using mobiles in class. The school is broke with no money for tokens and no money to upgrade 365 licenses. Pretty much between a rock and a hard place.

 

We had a similar issue, We got around this by using the authenticator.cc plugin for chrome. Might help if your case. They can still have the authenticator app installed for when they're at home.

[Jobos]

We had a similar issue, We got around this by using the authenticator.cc plugin for chrome. Might help if your case. They can still have the authenticator app installed for when they're at home.

 

How secure is the plug-in as I thought using something separate from the computer you’re using for email was the way forward.