Inna student-information system breach — Icelandic upper-secondary schools; student altered grades/attendance records
Severity: medium · Patch status: no-fix-needed · Since 2026-11-04
A security breach affected Inna, the student-information system used by Icelandic upper-secondary schools, allowing a student to attempt to alter other pupils' grades and attendance records. Up to 16 schools may be affected. Iceland's Data Protection Authority has received three notifications, while schools and the system operator are still investigating what information may have been accessed. The misuse was discovered by schools; the exact scope of accessed data and whether grade changes succeeded remain unclear. No CVE applies; remediation centres on access-control review and audit of records rather than a software patch.
What to do
- Audit Inna records for unauthorised changes to grades and attendance and correct any tampering
- Review and tighten access controls and permissions in Inna for student accounts
- Notify affected students and parents as required under GDPR
- Complete incident reporting to the Data Protection Authority
- Monitor for further misuse and review logging/audit trails
Sources
All live incidents on Threat Watch
