{"id":234539,"date":"2025-09-13T05:00:00","date_gmt":"2025-09-13T04:00:00","guid":{"rendered":"https:\/\/schoolsweek.co.uk\/?p=234539"},"modified":"2025-09-19T16:21:00","modified_gmt":"2025-09-19T15:21:00","slug":"the-intradev-breach-is-a-wake-up-call-on-cyber-risk-management","status":"publish","type":"post","link":"https:\/\/schoolsweek.co.uk\/the-intradev-breach-is-a-wake-up-call-on-cyber-risk-management\/","title":{"rendered":"The Intradev breach is a wake-up call on cyber risk management"},"content":{"rendered":"\n

The recent cyber-attack on the Online Single Central Record (Online SCR) supplier Intradev<\/a> has sent shockwaves through the education sector, affecting many schools and thousands of school staff.<\/p>\n\n\n\n

While this incident is deeply concerning, it can serve as a learning opportunity for schools in their relationship with edtech vendors.<\/p>\n\n\n\n

Ultimately, it highlights the trade-off in risks that often occurs when procuring technology services and the need for robust, proactive risk management.<\/p>\n\n\n\n

Outsourcing\u2019s hidden trade-off<\/strong><\/h3>\n\n\n\n

Using the services of an external company to manage processes such as your single central record (SCR) and recruitment checks is perfectly valid.<\/p>\n\n\n\n

Many edtech vendors provide high-quality platforms that reduce workload as well as risk by efficiently identifying gaps and errors in the record.<\/p>\n\n\n\n

However, reducing risks in one area doesn\u2019t eradicate risk altogether. In fact, transferring sensitive data to an external supplier creates a new one.<\/p>\n\n\n\n

Many schools we speak to acknowledge they haven\u2019t considered this trade-off, and this is the crux of the problem.<\/p>\n\n\n\n

In the case of the Online SCR incident, it was the platform\u2019s own software supplier Intradev that was hit by the cyber-attack. Hackers were then able to access the names, addresses and phone, national insurance and passport numbers of school staff.<\/p>\n\n\n\n

This illustrates the complexity of modern data-sharing arrangements and the critical importance of understanding exactly what data flows where.<\/p>\n\n\n\n

Therefore, risk management should be front and centre of any technology procurement exercise, never just an afterthought.<\/p>\n\n\n\n

Data protection issues aren\u2019t going away<\/strong><\/h3>\n\n\n\n

With the Department for Education encouraging schools to embrace AI tools, and Browne Jacobson\u2019s School Leaders Survey<\/a> last autumn showing that half of schools are using AI tools in the classroom<\/a>, the volume of data being shared with external vendors is only going to increase.<\/p>\n\n\n\n

As a result, so is risk.<\/p>\n\n\n\n

The consequences of data being compromised are far and wide. The Information Commissioner\u2019s Office last year reprimanded an Essex school<\/a> for failing to protect data when installing facial recognition technology, while some staff have been asking for schools to compensate them following the Online SCR cyber-attack.<\/p>\n\n\n\n

Strategic risk management<\/strong><\/h3>\n\n\n\n

The first time that trustees or governors become aware of risk shouldn’t be when they are asked to deal with a data breach. Maturely accepting and managing vendor risk means:<\/p>\n\n\n\n

Involving Data Protection Officers<\/em><\/strong> (DPOs) from the outset<\/strong><\/em><\/h4>\n\n\n\n

Schools should always assess data risks and conduct vendor due diligence before entering into contracts. Your DPO should be involved from the very beginning of any tech procurement exercise to help to bring a focus on data protection risks.<\/p>\n\n\n\n

Conducting thorough Data Protection Impact Assessments (DPIAs)<\/em><\/strong><\/h4>\n\n\n\n

When talking to vendors, read their terms and conditions, and privacy notices. A DPIA isn’t just a box-ticking exercise; it’s your opportunity to understand and mitigate risks before they materialise.<\/p>\n\n\n\n

Get proper legal advice<\/em><\/strong><\/h4>\n\n\n\n

When entering into high-risk processing activities where significant amounts or sensitive personal data might be shared, seek independent legal advice to review or draw up contracts that ensure any risks are effectively mitigated.<\/p>\n\n\n\n

Transparent governance<\/em><\/strong><\/h4>\n\n\n\n

Schools might decide after reading the contract that there is still risk. However, they can then ensure their governors or trustees are making a fully-informed decision on whether to proceed.<\/p>\n\n\n\n

The Online SCR incident should be a wake-up call for the entire education sector.<\/p>\n\n\n\n

The worst thing schools can do is fail to acknowledge risk at outsourcing tasks to edtech vendors. Instead, they must start viewing edtech procurement through a risk management lens, understanding that every technological solution promising to solve one problem may well create others.<\/p>\n\n\n\n

The key is not to avoid all risk. That would be impossible and counterproductive. Instead, it is to understand, assess and consciously manage it.<\/p>\n\n\n\n

The future of education technology is bright, but only if we approach it with our eyes wide open to both its benefits and its risks. The time for naive optimism is over; the era of informed, strategic decision-making must begin now.<\/p>\n","protected":false},"excerpt":{"rendered":"

The time for na\u00efve optimism on tech security is over. Here\u2019s how school leaders can begin to make informed, strategic decisions about procurement<\/p>\n","protected":false},"author":311124,"featured_media":234439,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"footnotes":""},"categories":[6,3734],"tags":[],"post-theme":[3726],"class_list":["post-234539","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-opinion","category-the-leader","post-theme-the-legal-leader"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t