An unauthorized party accessed and extracted email addresses from a deprecated sign-on system used by UK education software provider Bromcom, the company confirmed in a notice to customers.

The breach involved the legacy single sign-on (SSO) registration feature within Bromcom's Communication Server environment. According to a post on the EduGeek forum attributed to an account named Bromcom_Alastair, the intruder obtained email addresses linked to SSO registrations, along with registration timestamps and internal reference numbers. No passwords, authentication tokens, or sensitive student records were compromised, the company stated.

Bromcom discovered the intrusion on September 6 following reports of irregular SSO activity. The compromised component had remained active despite being superseded, as it continued to be referenced by an internal system. The company has since removed the legacy functionality from production and is collaborating with external forensic experts to assess the full scope of the incident.

The affected system did not interface with Microsoft or Google authentication services, limiting exposure to email addresses only. Bromcom emphasized that its core Management Information System, which stores student attendance, behavior, and administrative data, remained secure.

The provider serves over 5,000 schools and 390 multi-academy trusts across the UK, including recent clients such as Newport City Council, the Ministry of Defence, Warwickshire County Council, and the Northern Ireland Education Authority. The Register has sought further comment from Bromcom, which has not yet responded.