Children's private records leaked on internet from independent school applications
Sensitive Information about hundreds of children, including details of their behavioural problems, has been leaked on the internet after an alleged cyber attack on a company advising parents about applying for top independent schools.
The security breach led to the publication of 1,367 private records, including the names and addresses of pupils and parents and confidential notes about their children’s personality and school achievements and, in some cases, illnesses and learning difficulties.
Among those who had their family details disclosed were a leading television actor, a pop star and the son of a former Cabinet minister.
The list also includes the families of senior businessmen, bankers, lawyers, Foreign Office officials and senior military personnel.
One of the victims, a prominent businesswoman who used the company to try to find a school for her son, said it was “a terrible breach of privacy”.
“We trusted this firm to try to get help with our son’s education,” she said. “They have totally breached that trust.”
Last week, this newspaper alerted the Information Commissioner’s Office (ICO), which said it was opening an investigation.
The watchdog has the power to begin a criminal prosecution and to fine companies as much as £500,000 for serious breaches of privacy.
The security breach centres around a database of information about clients seeking help getting their children into Britain’s independent schools.
What should have been private information protected by internet security could be viewed using a Google search.
Many families on the database had been looking for advice on which schools were centres of academic, musical or sporting excellence.
Several of the children were already at top public schools and were looking to move to “less formal” or less academically-challenging environments.
The greatest breach of trust surrounds details of the children written by their parents.
Descriptions of the named children include: “His weakness is that he doesn’t keep his mind focused on [what] he is doing … he is distracted very easily.”
Others talk about their children suffering from attention deficit hyperactivity disorder, Asperger’s syndrome, dyslexia and dyspraxia, or reveal children’s special needs such as autism.
The company behind the blunder, Gabbitas, is one of the leading firms in the field, and publishes the Independent Schools Guide. It charges a minimum of £199 an hour for personal advice to parents about the right school for their child.
It also offers private tutoring and guardianship provision for children, careers advice and guidance, and recruitment support or management consultancy to schools.
Gabbitas is owned by outsourcing firm Prospects Services, which has a number of multi-million pound government education contracts, and had a turnover of £77 million last year.
The database was published on the UK Independent Schools Guide website. After being alerted by this newspaper, Prospects Services shut down the website.
The firm has claimed that the information had been available on its website only because it had been the victim of a cyber attack.
It said it was “deeply concerned” about the incident, and it had now secured its website and would be asking police to investigate.
“We apologise unreservedly to any individuals who may be affected,” a spokesman said.
An spokesman for the ICO said: “We are grateful to The Sunday Telegraph for bringing this possible data breach to our attention.
"We will be making inquiries into the circumstances of any potential breach of the Data Protection Act before deciding what action, if any, needs to be taken.”
