Data Security Incident Affecting Enrolment Records

Data Security Incident Affecting Enrolment Records

What Happened?

On the morning of 5 June 2026, an enrolment link was issued to a student which, due to a system configuration error, temporarily allowed access to enrolment forms submitted by other applicants.

The issue was reported to the College promptly, and we immediately disabled access to the online application and enrolment system while we conduct a full investigation.

What Information May Have Been Affected?

Our investigation indicates that some enrolment and application forms may have been visible to other students during this incident. These forms contain personal information provided during the enrolment process, which may include sensitive (special category) data.

At this stage, there is no evidence of malicious activity or large-scale downloading of data.

What Action Has Been Taken?

We have taken the following steps:

• The system was taken offline within 45 minutes of the issue being reported and will remain unavailable while we complete a thorough investigation
• We are engaging independent cybersecurity specialists to support our investigation and strengthen system security.
• The incident has been reported to the Information Commissioner’s Office (ICO) within the required 72-hour timeframe.
• A thorough internal review is underway to ensure appropriate safeguards are in place before the system is restored.

What Should You Do?

As a precaution, we recommend that you:

• Remain vigilant for any unexpected or suspicious emails, text messages, or phone calls (potential phishing attempts).
• Do not share personal or financial information in response to unsolicited communications.

Our Response

We sincerely apologise for this incident and understand the concern it may cause. Protecting personal data is a priority for the College, and we are taking this matter extremely seriously.

We are strengthening our systems and processes, including additional security measures and external expert support, to prevent this from happening again.

Contact Information

If you have any questions or concerns, please contact us:

Email: foi@derwentside.ac.uk

We will respond as quickly as possible during normal business hours.

Data Protection Officer:

Ian Oyston (IT Manager)