Thief snatches school snapper's SD cards in smash & grab

The security of children's personal data is compromised by a physical break-in. This incident requires immediate action to update access credentials and review security protocols.

A secondary school in the UK, Priory School in Lewes, is facing a potential data protection issue after a photographer's vehicle was broken into, leading to the theft of SD cards. The stolen cards may contain photographs of pupils, along with QR code cards that link to their names and class information. The incident occurred between October 6 and 7, when a company hired by the school, Pret-a-Portrait, had one of its vehicles broken into. While the company believes most of the data may have been overwritten, they cannot be certain. The school emphasized that no personal addresses, contact details, financial, medical, or safeguarding records are affected, as these are stored on the school's own systems. Pret-a-Portrait has taken steps to mitigate damage, including taking photos offline, changing access IDs, and reinforcing its procedures, and has reported the incident to the police and the ICO.

The breach highlights the ongoing risks associated with physical data storage and the supply chain for school services. Even with digital processes, the vulnerability of physical media like SD cards remains a significant concern, especially when personal data is involved. The school's proactive communication and the photographer's immediate mitigation steps, such as taking data offline and changing access IDs, are crucial for managing the fallout.

This event underscores the need for robust data security policies that extend beyond digital defenses to encompass all physical touchpoints where data is handled. Schools and their vendors must continuously assess and strengthen their procedures to prevent such incidents and ensure compliance with data protection regulations, especially when dealing with sensitive information like children's identities and affiliations.