2021 British Council — open Azure blob exposed ~144k student files (third-party hosted); ICO notified

Researcher discoveries reported by BleepingComputer, SecurityWeek, and Security Affairs in December 2021 found a misconfigured Microsoft Azure blob holding more than 144,000 files with student administration metadata for the British Council’s international education programs. The Council attributed storage to a third-party supplier, secured the container after responsible disclosure, and stated a materially smaller subset (on the order of ~10,000 learner records) bore significant exposure—while researchers enumerated a wider file count. Separately, trade coverage referenced two ransomware incidents in prior years causing operational downtime; this row focuses on the verifiable cloud misconfiguration event.