Ormiston Herman Academy Website

Ormiston Academies Trust did not have the information requested.

Dear Ormiston Academies Trust,

I would like to make the following request under the Freedom of Information Act 2000;

Since last week the Ormiston Herman Academy website displayed some apparently unauthorised links on the website.

These links led to sites such as adult dating sites and bitcoin selling sites.

It would appear the website was compromised.

Are the Ormiston Herman Academy or the Ormiston Academies Trust aware of this?
If so have steps been taken to rectify the pages and secure the website from further breaches?
Has this breach affected any other Ormiston systems or put the personal data of pupils, parents or staff at risk?

Yours faithfully,

Oscar

Info, Ormiston Academies Trust

Dear Oscar,
Thank you for the email this will be sent to the department who will be in
touch within 20 working days.
Kind regards

Get [1]Outlook for Android

Sara Smith | Receptionist/Administrator | Ormiston Academies Trust
DD: +44 121 262 4712 | M: +44 7973 951000 | E:
[2][email address]

Ormiston Academies Trust.
One Victoria Square, Birmingham, B1 1BD
[3]Phone 0121 236 5100
[4]Email[5] [Ormiston Academies Trust request email]

[6]Globe [7]Facebook [8]Twitter [9]LinkedIn [10]YouTube

[11][IMG]

 

IMPORTANT NOTICE: This message contains confidential information and is
intended only for the recipient. If you are not the recipient you should
not disseminate, distribute or copy this email. Please notify
[email address] immediately if you have received
this email by mistake and delete this email from your system. Email
transmission cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, destroyed, arrive late
or incomplete, or contain viruses. Ormiston Academies Trust does not
accept liability for any errors or omissions in the content of this
message, which arise as a result of email transmission. Ormiston Academies
Trust is a limited registered company in England and Wales, registration
number 06982127. The registered office for Ormiston Academies Trust is One
Victoria Square, Birmingham, B1 1BD .

 

 

--------------------------------------------------------------------------

From: Oscar <[FOI #705283 email]>
Sent: Thursday, November 12, 2020 10:04:51 AM
To: Info <[Ormiston Academies Trust request email]>
Subject: Freedom of Information request - Ormiston Herman Academy Website
 
Dear Ormiston Academies Trust,

I would like to make the following request under the Freedom of
Information Act 2000;

Since last week the Ormiston Herman Academy website displayed some
apparently unauthorised links on the website.

These links led to sites such as adult dating sites and bitcoin selling
sites.

It would appear the website was compromised.

Are the Ormiston Herman Academy or the Ormiston Academies Trust aware of
this?
If so have steps been taken to rectify the pages and secure the website
from further breaches?
Has this breach affected any other Ormiston systems or put the personal
data of pupils, parents or staff at risk?

Yours faithfully,

Oscar

-------------------------------------------------------------------

Please use this email address for all replies to this request:
[FOI #705283 email]

Is [Ormiston Academies Trust request email] the wrong address for Freedom of
Information requests to Ormiston Academies Trust? If so, please contact us
using this form:
[12]https://linkprotect.cudasvc.com/url?a=ht...

Disclaimer: This message and any reply that you make will be published on
the internet. Our privacy and copyright policies:
[13]https://linkprotect.cudasvc.com/url?a=ht...

For more detailed guidance on safely disclosing information, read the
latest advice from the ICO:
[14]https://linkprotect.cudasvc.com/url?a=ht...

Please note that in some cases publication of requests and responses will
be delayed.

If you find this service useful as an FOI officer, please ask your web
manager to link to us from your organisation's FOI page.

show quoted sections

Rebecca Okey, Ormiston Academies Trust

Dear Oscar

Please find below the answer to your Freedom of Information request:

 

Since last week the Ormiston Herman Academy website displayed some
apparently unauthorised links on the website.

These links led to sites such as adult dating sites and bitcoin selling
sites.

It would appear the website was compromised.

 

Are the Ormiston Herman Academy or the Ormiston Academies Trust aware of
this?

 

Ormiston Academies Trust is not aware of any breach of the  security of
the Ormiston Herman Academy website.  The site went down between the hours
of 12:18:23 on 10 November 2020 and  09:45:23 on 11 November 2020. This
was due to a technical issue which was addressed.  Prior to, during, and
after this down time, there was no evidence of a security breach.

 

If so have steps been taken to rectify the pages and secure the website
from further breaches?

 

As above, there is no evidence that there has been a security breach. 
Please be assured that the security of the website  and the academy’s
systems continue to be  protected by robust processes and procedures in
place.

Has this breach affected any other Ormiston systems or put the personal
data of pupils, parents or staff at risk?

 

No personal data is held on the Ormiston Herman website.  Personal data of
students, their parents/carers and staff is held separately on the academy
server.  The website is cloud based and is entirely separate from the
academy systems.

 

Best wishes

 

Rebecca Okey

 

 

Rebecca Okey | Executive Assistant | Ormiston Academies Trust
DD: +44 121 262 4761 | M: +447583 080639 | E:
[1][email address]

Ormiston Academies Trust.
One Victoria Square, Birmingham, B1 1BD
[2]Phone 0121 236 5100
[3]Email[4] [Ormiston Academies Trust request email]

[5]Globe [6]Facebook [7]Twitter [8]LinkedIn [9]YouTube

[10][IMG]

 

IMPORTANT NOTICE: This message contains confidential information and is
intended only for the recipient. If you are not the recipient you should
not disseminate, distribute or copy this email. Please notify
[email address] immediately if you have received
this email by mistake and delete this email from your system. Email
transmission cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, destroyed, arrive late
or incomplete, or contain viruses. Ormiston Academies Trust does not
accept liability for any errors or omissions in the content of this
message, which arise as a result of email transmission. Ormiston Academies
Trust is a limited registered company in England and Wales, registration
number 06982127. The registered office for Ormiston Academies Trust is One
Victoria Square, Birmingham, B1 1BD .

 

 

From: Oscar <[11][FOI #705283 email]>
Sent: Thursday, November 12, 2020 10:04:51 AM
To: Info <[12][Ormiston Academies Trust request email]>
Subject: Freedom of Information request - Ormiston Herman Academy Website

 

Dear Ormiston Academies Trust,

I would like to make the following request under the Freedom of
Information Act 2000;

Since last week the Ormiston Herman Academy website displayed some
apparently unauthorised links on the website.

These links led to sites such as adult dating sites and bitcoin selling
sites.

It would appear the website was compromised.

Are the Ormiston Herman Academy or the Ormiston Academies Trust aware of
this?
If so have steps been taken to rectify the pages and secure the website
from further breaches?
Has this breach affected any other Ormiston systems or put the personal
data of pupils, parents or staff at risk?

Yours faithfully,

Oscar

-------------------------------------------------------------------

Please use this email address for all replies to this request:
[13][FOI #705283 email]

Is [14][Ormiston Academies Trust request email] the wrong address for Freedom of
Information requests to Ormiston Academies Trust? If so, please contact us
using this form:
[15]https://linkprotect.cudasvc.com/url?a=ht...

Disclaimer: This message and any reply that you make will be published on
the internet. Our privacy and copyright policies:
[16]https://linkprotect.cudasvc.com/url?a=ht...

For more detailed guidance on safely disclosing information, read the
latest advice from the ICO:
[17]https://linkprotect.cudasvc.com/url?a=ht...

Please note that in some cases publication of requests and responses will
be delayed.

If you find this service useful as an FOI officer, please ask your web
manager to link to us from your organisation's FOI page.

show quoted sections

Dear Ormiston Academies Trust,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Ormiston Academies Trust's handling of my FOI request 'Ormiston Herman Academy Website'.

The reason is that the following independently archived pages of the Ormiston Herman Academies website do suggest to me of 'evidence that there has been a security breach';

https://archive.is/ZyztF
https://archive.is/TMD7Y
https://archive.is/owzgg

These cached pages show the content of the Ormiston Herman Academies website as at the beginning of November. Some of the links remain active and, for example at the time of writing, clicking on the link 'spin palace free spins' in one of the pages leads to a website offering online casino facilities.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/o...

Yours faithfully,

Oscar

Oscar left an annotation ()

Additional link https://archive.is/uOlY2

Dear Rebecca Okey,

I've notice the Ormiston Academies Trust has been unable to resolve the information or find evidence regarding my request. I will therefore assume that the Trust is unaware of the continued apparent unauthorised information on it's systems.

Please view this link below that shows the Ormiston Herman Academy website is still being used to promote online casinos:

http://ohacademy.co.uk/en-CA/royal-vegas...

The link is available on the ohacademy.co.uk domain and is active as at the time of writing but I provide below an independently archived copy of the link that was archived at the time of writing (31-12-20):

https://archive.is/wR5fr

There are a number of other links still active on the systems promoting pharmacy medication supplies, casinos, and adult sites. Unfortunately the adult sites being promoted display graphic images inappropriate to be displayed via school websites hence could be regarded as a safeguarding concern if pupils stumbled on the links, which are available publicly.

I have compiled a report which contains all the links that I believe to be unauthorised, the method by which the apparently unauthorised pages can be remotely modified to display different promotional information, at will, by whomever has control over these pages and possible causes of how the pages were installed.

I am happy to provide this report to any interested parties on request.

I will now close this request marked as "They do not have the information" and I hope this helps the Ormiston Academies Trust to rectify the issues.

Yours sincerely,

Oscar

Rebecca Okey, Ormiston Academies Trust

Thank you for your email.  I am out of the office now until 5 January 2021
and I will reply to you then.

 

Best wishes

 

Rebecca

Rebecca Okey | Executive Assistant | Ormiston Academies Trust
DD: +44 121 262 4761 | M: +447583 080639 | E:
[1][email address]

Ormiston Academies Trust.
One Victoria Square, Birmingham, B1 1BD
[2]Phone 0121 236 5100
[3]Email[4] [Ormiston Academies Trust request email]

[5]Globe [6]Facebook [7]Twitter [8]LinkedIn [9]YouTube

[10][IMG]

 

IMPORTANT NOTICE: This message contains confidential information and is
intended only for the recipient. If you are not the recipient you should
not disseminate, distribute or copy this email. Please notify
[email address] immediately if you have received
this email by mistake and delete this email from your system. Email
transmission cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, destroyed, arrive late
or incomplete, or contain viruses. Ormiston Academies Trust does not
accept liability for any errors or omissions in the content of this
message, which arise as a result of email transmission. Ormiston Academies
Trust is a limited registered company in England and Wales, registration
number 06982127. The registered office for Ormiston Academies Trust is One
Victoria Square, Birmingham, B1 1BD .

 

 

References

Visible links
1. mailto:[email address]
4. mailto:[Ormiston Academies Trust request email]
5. http://www.ormistonacademiestrust.co.uk/
6. https://facebook.com/OrmistonAcademiesTr...
7. https://twitter.com/OrmistonAcads
8. https://linkedin.com/company/ormiston-ac...
9. https://youtube.com/OrmistonUK
10. https://www.gov.uk/coronavirus

Rebecca Okey, Ormiston Academies Trust

Dear Oscar

Thank you for your email.  When I received your original Freedom of
Information request, the matter was investigated and I replied
accordingly, in good faith and in compliance with the Freedom of
Information Act.  In light of the further information you have provided
below. I have asked our IT manager to look in to this again with immediate
effect.

Kind regards

Rebecca Okey

Rebecca Okey | Executive Assistant | Ormiston Academies Trust
DD: +44 121 262 4761 | M: +447583 080639 | E:
[1][email address]

Ormiston Academies Trust.
One Victoria Square, Birmingham, B1 1BD
[2]Phone 0121 236 5100
[3]Email[4] [Ormiston Academies Trust request email]

[5]Globe [6]Facebook [7]Twitter [8]LinkedIn [9]YouTube

[10][IMG]

 

IMPORTANT NOTICE: This message contains confidential information and is
intended only for the recipient. If you are not the recipient you should
not disseminate, distribute or copy this email. Please notify
[email address] immediately if you have received
this email by mistake and delete this email from your system. Email
transmission cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, destroyed, arrive late
or incomplete, or contain viruses. Ormiston Academies Trust does not
accept liability for any errors or omissions in the content of this
message, which arise as a result of email transmission. Ormiston Academies
Trust is a limited registered company in England and Wales, registration
number 06982127. The registered office for Ormiston Academies Trust is One
Victoria Square, Birmingham, B1 1BD .

 

 

show quoted sections

Rebecca Okey, Ormiston Academies Trust

1 Attachment

  • Attachment

    2021.01.07 StayHome NURSE eSignature da8d67e8 9380 4879 86ec 44806d454fd0.jpg

    1.3M Download

Dear Sir

Thank you for getting in touch.  Our IT Manager has now identified and
fixed the  rogue link on the  Ormiston Herman Academy website. We will
continue to monitor the site over the next couple of weeks.

Thank you for bringing this matter to our attention, though I am sorry you
had cause to do so.

Best wishes

Rebecca

Rebecca Okey | Executive Assistant | Ormiston Academies Trust
DD: +44 121 262 4761 | M: +447583 080639 | E:
[1][email address]

Ormiston Academies Trust.
One Victoria Square, Birmingham, B1 1BD
[2]Phone 0121 236 5100
[3]Email[4] [Ormiston Academies Trust request email]

[5]Globe [6]Facebook [7]Twitter [8]LinkedIn [9]YouTube

[10][IMG]

 

IMPORTANT NOTICE: This message contains confidential information and is
intended only for the recipient. If you are not the recipient you should
not disseminate, distribute or copy this email. Please notify
[email address] immediately if you have received
this email by mistake and delete this email from your system. Email
transmission cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, destroyed, arrive late
or incomplete, or contain viruses. Ormiston Academies Trust does not
accept liability for any errors or omissions in the content of this
message, which arise as a result of email transmission. Ormiston Academies
Trust is a limited registered company in England and Wales, registration
number 06982127. The registered office for Ormiston Academies Trust is One
Victoria Square, Birmingham, B1 1BD .

 

 

show quoted sections