# School Photography Data Breach Following Vehicle Theft Stolen SD cards containing student images trigger data protection concerns at UK school. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-10-16 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/566520fc-d23d-4942-8644-0889f341568a ## Vehicle Break-in Incident A smash-and-grab theft occurred between October 6 and 7, targeting a vehicle owned by photography firm Pret-a-Portrait. The incident resulted in the loss of camera bags containing SD memory cards. These cards held images from Priory School in Lewes, alongside QR code identifiers linking pupils to their specific class names. ## Scope of Data Exposure The stolen equipment was utilized for three additional photography jobs after the visit to Priory School on October 1. Consequently, the company believes most files may have been overwritten by subsequent photography sessions. However, they cannot confirm the exact status of the data, leaving the potential scope of the breach currently uncertain. ## Nature of Compromised Information The potentially exposed data includes student photographs and associated class information used during the photography process. Fortunately, critical school records remain secure. Addresses, contact details, financial information, medical records, and safeguarding data stored within the school’s internal systems were not affected by this theft, as they were never on the stolen cards. ## Lack of Improper Access Owner Nick Kerr stated that no physical, printed photographs were in the vehicle during the theft. Preliminary internal analysis by the firm indicates no evidence of improper access to the image files between the time of the theft and the moment the remaining digital assets were taken offline by the company's technical team. ## Immediate Mitigation Measures Pret-a-Portrait responded by taking all school photos offline immediately to prevent further exposure. They also updated the unique identifiers used to access the online galleries. These technical steps were designed to contain the potential risk while the company worked alongside the school’s Data Protection Officer to assess the full security impact. ## Procedural Security Overhaul Following the incident, the photography firm implemented new operational protocols to prevent future occurrences. The company now mandates that all SD cards must be wiped at the conclusion of each individual commission. Furthermore, they have conducted a comprehensive review of their internal security procedures to strengthen the protection of sensitive client data. ## Regulatory and Legal Reporting The firm has formally reported the theft to both the local police and the Information Commissioner's Office. By engaging with these regulatory bodies, the company ensures compliance with data protection standards while managing the incident. Headteacher Jon Curtis-Brignell has maintained open communication with families to address concerns regarding the potential data protection pickle. ## Ensuring Future Data Safety This incident highlights the critical intersection of physical security and digital data protection. While no evidence of misuse exists, the school and the vendor are prioritizing transparency. Moving forward, the implementation of strict data wiping policies serves as a necessary safeguard against the inherent risks of mobile data storage in photography. ## Sources covering this story - https://www.theregister.com/security/2026/10/16/thief-snatches-school-snappers-sd-cards-in-smash-grab/5303379 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._