Theft of photographer's SD cards puts pupil data from UK's Priory School at risk
A vehicle belonging to school photography firm Pret-a-Portrait was broken into overnight on 6-7 October, and a camera bag containing SD memory cards was stolen. The cards may hold photographs taken at Priory School in Lewes, UK, plus images of QR code cards showing pupils' names and class names. The same equipment was used for three further photography jobs after the school visit on 1 October, so the company believes "most, if not all" of the school's files were overwritten, though it cannot be certain. The firm reported the incident to the police and the ICO, and says there is no evidence the files were improperly accessed or misused.
Technical Details
- Physical theft (vehicle break-in) of removable media. No cyber intrusion is described.
- Potentially exposed data: pupil photographs, names and class information tied to the photography process.
- Not affected: addresses, contact details, financial and medical information, and safeguarding records held in the school's own systems.
- Pret-a-Portrait's analysis found no improper access to the pictures between the theft and the images being taken offline.
Remediation
- Pret-a-Portrait took all school photos offline and changed the IDs used to access them.
- It now wipes all SD cards at the end of each commission and has reviewed and strengthened its procedures.
- The school worked with its Data Protection Officer and notified families.
Linha do tempo
-
Theft of photographer's SD cards puts pupil data from UK's Priory School at risk
ler a análise desta fonte ocultar
A vehicle belonging to school photography firm Pret-a-Portrait was broken into overnight on 6-7 October, and a camera bag containing SD memory cards was stolen. The cards may hold photographs taken at Priory School in Lewes, UK, plus images of QR code cards showing pupils' names and class names. The same equipment was used for three further photography jobs after the school visit on 1 October, so the company believes "most, if not all" of the school's files were overwritten, though it cannot be certain. The firm reported the incident to the police and the ICO, and says there is no evidence the files were improperly accessed or misused.
Technical Details
- Physical theft (vehicle break-in) of removable media. No cyber intrusion is described.
- Potentially exposed data: pupil photographs, names and class information tied to the photography process.
- Not affected: addresses, contact details, financial and medical information, and safeguarding records held in the school's own systems.
- Pret-a-Portrait's analysis found no improper access to the pictures between the theft and the images being taken offline.
Remediation
- Pret-a-Portrait took all school photos offline and changed the IDs used to access them.
- It now wipes all SD cards at the end of each commission and has reviewed and strengthened its procedures.
- The school worked with its Data Protection Officer and notified families.