The Information Commissioner's Office (ICO) has found a school in Hampshire in breach of the Data Protection Act (DPA) after the personal details of nearly 20,000 people were put at risk when the school's website was hacked.
According to an undertaking signed by Bay House School, computer hackers, including at least one of its own pupils, accessed the school's internal information management system via an attack on the school's remotely-hosted website.
In March, hackers gained access to the system after discovering that a member of staff used the same password to log into the school's web and management systems. Despite Bay House School having a policy in place to prohibit the use of duplicate passwords, the school did not have checks in place to ensure the policy was adhered to.
As a result, the personal details of 20,000 individuals, including teachers, parents and around 7,600 pupils risked being exposed online. The data included names, addresses, photographs and some sensitive medical history information.
The problem was identified shortly after the hack occurred and the security of the website was immediately restored.
The school will now ensure that reasonable measures are taken to encrypt and separate sensitive and confidential information held on the school's management system. It will also remind staff of the duplicate passwords policy, and at least annually carry out penetration testing on the school's IT systems to ensure the personal information held remains secure.
"While it can be difficult to remember lots of different passwords, it is vitally important that individuals do not use the same password to log in to data systems that are supposed to be kept secure. This is particularly important when the systems allow access to sensitive information relating to young adults," said Sally Anne Poole, acting head of enforcement at the ICO.