Bromcom

Hunt your mail gateways for running processes whose program file has been deleted.

Seven, Bromcom makes software for UK schools.

It replaced an old sign-on registration service but left it running because an internal system called it.

An attacker used that old service to pull email addresses, which sign-in server each person used, and their sign-in dates.

No passwords were held there.

Bromcom spotted the break-in on September sixth and told customers later that month.

Most networks have a service like that somewhere.

When you replace a service, find out what still calls the old one and switch it off.