One of the Union's Digital Service providers had a data breach affecting University of Portsmouth students.

What happened?

  • Typeform identified the breach at 14:00 CET on June 27th, and remedied the apparent cause of the breach at 14:30 CET on June 27th.  
  • Typeform have since been performing a full forensic investigation of the incident to be certain that this cannot happen again.  The risk of reoccurrence is now deemed low enough to send out this communication.
  • The results that were accessed are from a partial backup dated May 3rd, 2018.  Results collected since May 3rd 2018 are therefore safe and not compromised.

What do you mean by "compromised"?

In this case, "compromised" means that the attacker obtained access to your data and downloaded it from our servers. Unfortunately, this means that the attacker has partial data you shared with us prior to May 3rd.

How does this impact me?

All the responses you provided us via Typeform prior to May 3rd on the following forms were potentially compromised:

  • Share Submission Form
  • Vote: Idea Vote Template
  • Vote: Invite suppliers to have a table at the Union
  • Vote: More recognition for course reps
  • Vote: Union to advertise all guest lectures run throughout the university
  • Vote: Improvement of signs for building facilities
  • Vote: A water slide/slip and slide in the summer; like a mini pool party in the garden of the Union
  • Vote: Donate clothes
  • Vote: We should lobby the University to provide more funding to the Union for student groups and staff
  • Student Elections 2015-16 - Recommend a Friend Form
  • Vote: It would be helpful if the uni bus drove through Elm Grove and Albert Road
  • Vote: Should have a representative for both genders not just women
  • Vote: There should be a men's officer as well as a women's officer
  • Vote: Guys need to talk to people too!
  • Vote: Student Group Info
  • Vote: Making it compulsary that all units on courses put all the lecture notes in single consolidated document
  • Vote: St micheals needs a general student area with chairs and tables
  • Vote:More Healthy food in vending machines/quick snacks
  • Vote:Timetables: Subjects should be condensed down
  • Vote: More printer credit for 2nd year business students
  • Vote: Let's get hydrated; save money and be ecofriendly. Water bottle refill fountains for every building
  • Vote: Put Laptops in Third Space
  • Vote: Access to more articles and journals. Also more copies of books
  • YMS17 Survey
  • May Elections 2017 - Nomination Form
  • Events Team Feedback 16/17 (https://upsu.typeform.com/to/GH8zsq)
  • Vote: More advice and links to career prospects for biological sciences
  • Elections - Expression of interest (https://upsu.typeform.com/to/EDPje0)
  • Elections 2018 - Nomination Form (https://upsu.typeform.com/to/IXde5N)

What data was compromised?

The results accessed were from a partial backup dated May 3rd, 2018. As a result, all data collected since May 3rd 2018 are not compromised. In most cases the data that was compromised was low risk to the rights and freedoms of individuals and included:

  • Name
  • Email Address
  • Student ID
  • Mobile Phone Number

In a small number of cases, where data was collected in the elections nominations form the following information which was considered a risk to the rights and freedoms of individuals following our assessment included:

  • Age
  • Gender
  • Sexual Orientation
  • Disability
  • Religious Belief
  • Ethnic Background
  • Photographic Image

What have you done about this as the data controller?

  • We've notified the Information Commissioners Officer (ICO) of the breach on the 24th July
  • The ICO are acting on the global release of data caused by this Typeform breach and will consider our case inline with this
  • We have written to all affected University of Portsmouth students affected on the 24th July
  • A limited number of individuals affected were business contacts as these personal rights and freedoms were at very low risk they have not been informed
  • We have published this article under the principle of transparency
  • We are working with Typeform to ensure we care reassured of their security provision