We were notified at 9.05pm on Friday 29 June that Typeform, a company we’ve used in the past to collect sign-up information and survey results, has suffered a data breach. 

The breach itself occurred on June 27 at 14.00 CET and was remedied by 14.30 CET. Attackers managed to access to partial data backups for surveys conducted before May 3 2018, which included data from survey respondents.

Typeform advised us that, unfortunately, a number of our forms were affected by this breach, and provided us with secure access to the compromised data at 3.58pm on Monday 2 July.

Some of our affected surveys were used to collect anonymous feedback only, which would not identify any individual. Of those which did contain personal data, the majority relates to names and email addresses only. However, a smaller number contained telephone details and student numbers. The compromised data did not include financial information or sensitive personal data.

We are really sorry to all those affected, and once we have identified respondents whose data may have been compromised, we will be emailing them directly to advise them what has happened. In the event that your name and email was downloaded by the attacker, you may see an increase in spam email, and we recommend being extra careful against potential phishing scams.

On Monday 2 July, we also reported the breach to the Information Commissioner's Office (ICO). We are reviewing our relationship with Typeform, and are in the processing of deleting all survey data currently held in Typeform, which will be destroyed or stored securely elsewhere if still required (data is stored anonymously where possible). In future, we will ensure that any survey data collected through any platform is deleted from this within two months of it actively being used, to reduce the potential impact.

The data we collect enables us to communicate, to evaluate and to provide support. We take the responsibility of collecting and storing personal data really seriously, and are committed to protecting the data that we hold. We are very sorry that this has happened, but we can assure you that we will be learning from this incident.