Up until 10:45 on 21 September, on the updated version of Tapestry, it was possible for logged in relatives with active accounts to, in restricted circumstances, see the names, groups and small profile photographs of other children in the setting. 

 

 

For children in the same setting as a relative:

 

* The names of other children 

* Small profile photos of other children

* The groups that other children were members of

 

 

* Any further information about the children (for instance, they could not see observations nor pictures relating to the child, nor any contact details)

* Anything about children in other settings

 

 

* Relatives using the updated version of the Tapestry website (https://tapestryjournal.com'>https://tapestryjournal.com)

 

 

* The public

* Inactive relatives

* Relatives at other settings

* Relatives on the original version of Tapestry (https://eylj.org'>https://eylj.org)

* Relatives using the Tapestry apps.

 

 

Relatives who logged into the updated version of the Tapestry website would not have seen this information in their routine use of Tapestry. 

 

However, if they were exploring menu items when making an observation, the information was available.

 

 

The fault existed from the time that a setting moved to the updated version of Tapestry until 10:45am on 21 September 2016. The longest period will have been 37 days. The majority of our customers have not moved, and will therefore not have been affected.

 

If you log into your setting using https://tapestryjournal.com then you are on the updated version of Tapestry. If you log into your setting using https://eylj.org then you are not.

 

 

We take the security of your data very seriously and are very sorry that this disclosure occurred. We are reviewing our procedures, particularly around the the way we test new features.

 

 

If you would like to discuss any aspect of this, please contact us at tapestry.security@eyfs.info

 

 

We are grateful for the prompt action of the relative who discovered the fault in reporting it to the nursery, and for the prompt action of the nursery in reporting it to us.