Affinity Learning Partnership, a UK education trust managing seven schools with over 650 employees, suffered a data breach originating from a cyberattack on its third-party software provider, Intradev, in August. The breach exposed sensitive employee data, including names, addresses, passport numbers, driving license details, National Insurance numbers, and background check records (e.g., DBS/QTS numbers). The attack was facilitated through OnlineSCR (Single Central Record Ltd), a service provider handling recruitment and criminal record checks for schools, which relied on Intradev’s compromised systems. The severity of exposure varied—some staff had only basic details (e.g., surnames) leaked, while others faced high-risk data compromise. Affinity notified affected employees, offered two years of CIFAS protective registration to mitigate fraud risks, and advised precautionary measures, though the ICO (Information Commissioner’s Office) did not mandate passport/driving license replacements. The incident underscores vulnerabilities in third-party supply chains, where attacks on service providers (e.g., Intradev) cascade to clients like schools, which often lack robust cybersecurity defenses. The breach highlights systemic risks in sectors holding sensitive personal data, particularly where budget constraints limit protective measures.