Affinity Learning Partnership, a UK education trust operating seven schools with over 650 employees, suffered a cyberattack via a third-party breach at software developer Intradev in August. The attack compromised employee personal data, including names, addresses, passport numbers, driving license details, and National Insurance numbers, stored by OnlineSCR (a DBS check provider for schools). The breach originated from Intradev, which detected unauthorized access on August 4, affecting multiple clients, including Access Personal Checking Services (APCS). While some staff faced minor exposure (e.g., surnames), others had high-risk data leaked, such as passport and National Insurance numbers. Affinity notified affected employees, offered CIFAS fraud protection, and advised precautionary measures, though the ICO did not mandate ID replacements. The incident underscores vulnerabilities in third-party supply chains and the targeting of education sector data due to limited cybersecurity budgets. The breach’s scope varied across schools, with potential long-term risks of identity theft or fraud for exposed staff.