Educacyl

Educacyl operates as an online portal designed to manage student absence records for educational institutions. The system stores a range of personal data belonging to students, their families, and teaching staff, including names, surnames, national identification numbers, dates of birth, nationality, addresses, phone numbers and email addresses. By centralising attendance information, the platform supports administrative processes related to student enrolment, monitoring and reporting. Access to the portal is intended for authorised users such as teachers, administrative personnel and, in some cases, parents or guardians.

The service is provided within the Spanish education sector, specifically under the authority of the regional education councilor whose office oversees its operation. While the prompt does not give quantitative details on the number of schools or users covered, the portal’s role in handling personal data indicates a broad reach across the jurisdiction it serves. Its function is tied to the management of compulsory education records, placing it within the public administration domain that deals with sensitive personal information.

Educacyl’s handling of identifiable information makes it subject to data protection legislation such as the GDPR and Spanish organic law on data protection. The May 2025 incident, in which a student allegedly impersonated a teacher to gain unauthorised access, highlighted the portal’s exposure to credential‑based threats and prompted a rapid internal investigation. Following detection, the education department reinforced security controls, deployed new network filters and activated monitoring alerts to deter further intrusion. The breach was reported to the Spanish Data Protection Agency and the Guardia Civil, and the National Institute of Cybersecurity warned that the compromised data could be exploited for identity theft, spam or fraudulent calls.

Organisationaly, Educacyl is situated within the regional government’s education structure, as evidenced by references to the education councilor’s public statements regarding the incident. This positioning implies that the portal is maintained and funded by the public administration rather than a private entity, and that its operational policies are aligned with regional educational policy and security directives. No further details about parent‑company relationships or subsidiaries are provided in the source material.