Incident Details
A school in Coventry received criticism for security breaches following three unauthorized entries into its IT system. As a result, the Information Commissioner's Office declared that Finham Park Multi Academy Trust lacked sufficient measures for locking accounts and setting passwords. The ICO's report revealed that an outside party gained access to Finham Park's systems using stolen login information and encrypted the data. The breach impacted a total of 1,843 individuals in the UK, with investigations showing deficiencies in Finham Park's account locking and password protocols.
Incident
How Did the Breach Happen?
Someone without permission used stolen login information to enter Finham Park's systems and encrypt them.
What Data has been Compromised?
1,843 individuals in the UK were impacted by the data breach.
Why Did the company's Security Measures Fail?
Finham Park lacked sufficient account lockout or password regulations.
What Immediate Impact Did the Breach Have on the company?
Finham Park Multi Academy Trust was sanctioned by the Information Commissioner's Office for its infringement of data protection regulations.
How could this have been prevented?
Implementing proper account lockout and password policies could have avoided the breach.
What have we learned from this data breach?
This incident underscores the significance of putting in place suitable technical and organizational safeguards to protect systems and providing employees with training on managing passwords effectively.
Summary of Coverage
Following three cyberattacks on its IT system, Finham Park Multi Academy Trust faced criticism for inadequate data protection measures. The breaches were the result of unauthorized access by a third party who used compromised credentials to breach and encrypt the trust's systems. An investigation by the ICO revealed deficiencies in the trust's account lockout and password policies, leading to 1,843 UK Data Subjects being impacted. The incident underscores the importance of enhancing security protocols and providing staff training on password security to mitigate such risks.