School Photographer’s Camera Bag Stolen With SD Cards Containing Kids’ Photos

A school photographer had their camera bag stolen, along with memory cards that may contain images of the children — raising concerns about a possible data breach.

According to a report by The Register, Priory School in town of Lewes in East Sussex, England alerted parents after the theft of the photographer’s camera bag containing SD memory cards of their childrens’ annual school photos. Pret-a-Portrait, the photography company hired by the Priory School, told them that one of its vehicles was broken into overnight last week, resulting in the theft.

There are fears that the incident could amount to a data breach, as the stolen memory cards may contain student photos and QR code cards displaying pupils’ names and class names.

“Pret-a-Portrait has informed us that, overnight between 6 and 7 October, one of its vehicles was broken into and a camera bag containing SD memory cards was stolen,” Jon Curtis-Brignell, the principal at Priory School, writes in an email this week, according to The Register.

“Some of these cards may have contained photographs taken at Priory School, together with images of the QR code cards used for school photographs, which show pupils’ names and class names.”

In the email, the principal says that the same equipment used to take the photos at Priory School was also used for three additional photography jobs after Pret-a-Portrait visited the school on October 1. Curtis-Brignell says that the potentially affected information included photographs, pupils’ names, and their “class information associated with the photography process.” Other types of data, such as addresses, contact details, financial information, medical information, and safeguarding records stored in the school’s own systems remain untouched.

SD Memory Cards to be Wiped After Every Photo Shoot

Pret-a-Portrait, a school, family, and event photography company with offices in the U.K., Qatar, and the UAE, tells the school that it believes “most, if not all” of the files containing pupils’ data will have been overwritten. However, the company cannot confirm that this is the case.

To reduce the risk of misuse, Pret-a-Portrait took all school photos offline after the theft, changed the IDs required to access them, and updated its procedures to ensure SD memory cards are wiped after every job.

The company also “reviewed and strengthened its procedures following the incident” and reported the theft to police and the Information Commissioner’s Office (ICO).

Nick Kerr, owner of Pret-a-Portrait, tells The Register that while the potential scope of the breach remains unclear, there is currently no evidence the stolen photo files were accessed.

“Our analysis reveals that no improper access to pictures from this job occurred in between the time of the theft and the pictures being taken offline.”

---

Image creditsHeader photo licensed via Depositphotos.