Data breach of third-party vendor puts personal info of students at risk

guest · Jul 23, 2019

Personal information for 70,000 Hawaii students potentially compromised
July 23, 2019
https://www.hawaiinewsnow.com/2019/...tion-hawaii-students-potentially-compromised/

Personal information for as many as 70,000 public school students may have been compromised after a University of Hawaii vendor charged with overseeing a college and career planning website detected “suspicious” unauthorized access to one of its servers.

Updates on the incident will be posted online here. The Department of Education is also sending a letter to parents of students who may have been impacted.
Authorities are investigating to determine the potential scope of the exposure.
Click to expand...

Possible Student Data Exposure FAQ, July 22, 2019

guest · Jul 23, 2019

Data breach of vendor puts personal info of Tennessee high school students at risk
July 23, 2019
https://www.wsmv.com/news/data-brea...cle_a319c472-ad73-11e9-a209-a7cf327c76a3.html

The Tennessee Higher Education Commission is currently investigating a possible data breach of a 3rd party vendor, that potentially has exposed personal information of thousands of public school students across Tennessee.

The information that may have been compromised does not include social security numbers or addresses, only personal information like names, birthdays, gender, ethnicity, and a small portion of records included ACT scores.
Graduation Alliance has hired independent forensic experts to perform a thorough investigation to determine whether any student information was accessed. At this time, no evidence has been found that any student data was viewed or taken from the Graduation Alliance servers.
Click to expand...

guest · Oct 20, 2019

This student hacked his school system to change his grades, but leaked other students' data
October 16, 2019
https://www.securitynewspaper.com/2...ge-his-grades-but-leaked-other-students-data/

You never know where a hacker might appear. Digital forensics specialists report that a teenager managed to infiltrate the systems of a high school in the suburbs of Maryland, US, to extract personal information, academic registers, and SAT test scores from more than 1300 students.

In a statement, Montgomery County revealed that the young man had accessed and downloaded the compromised data last October 3rd by accessing Naviance, an online software used by students at Wheaton High School and other schools in the district to prepare some matters on their college life.
According to the county’s digital forensics specialists, the student developed an algorithm capable of testing multiple combinations of usernames and passwords to access the online system, a kind of brute force attack. As a minor, the identity of the hacker has not been revealed.

In total, the accounts of 1,343 students and one parent were affected by the incident.
Click to expand...

According to the digital forensics specialists from the International Institute of Cyber Security (IICS), everything indicated that the teen planned to modify his school grades. However, it is still clear whether the student accessed this pre-university system incidentally or if he acted intentionally by seeking personal details about his classmates.
Click to expand...

Washington Post: Maryland student breaches computer security and steals data of nearly 1,350 teens

guest · Oct 20, 2019

Students hack into Chester County school district system for senior game, exposing student information
October 18, 2019
https://www.inquirer.com/education/downington-area-school-district-data-breach-hacking-20191018.html

A data breach of Downingtown Area School District’s college-preparatory program gave hackers access to thousands of students’ GPAs, SAT scores, and personal information.

The district, which has 17 schools, said it discovered attempted hacks into Naviance, a college and career resource website, on Oct. 11.
An investigation determined that the perpetrators obtained teacher-level access to district accounts, and then extracted student profile information, including student IDs, GPAs, and SAT scores, for the district’s more than 12,600 elementary, middle, and high school students, according to the district.

“We understand that the students had no malicious intent to access the information,” a district spokesperson said. “But actions do have consequences.”
The district is continuing to investigate the incident, and said that all students and teachers were required to change passwords and that “modifications have and will continue to be made to our internal practices.”
Click to expand...

guest · Oct 25, 2019

Downingtown schools data breach: ‘Brute-force’ hack or 21st-century teen curiosity?
October 25, 2019
https://www.inquirer.com/news/downi...-hacking-students-assassin-game-20191025.html

Downingtown officials say the students who got the Naviance data wanted to track down other players at their homes.
A different story has been circulating online.

The Downingtown East senior said he was asked by the student who initially obtained the data to help program automated motivational birthday messages to students — intended to be supportive following a string of student and alumni suicides.

“It’s an odd way of doing it. But he had very good intentions,” the senior said.
While admitting wrongdoing, the senior also faulted the district for inadequate security measures, this year and in the past. “This isn’t some elite hacking, it’s just first-year computer-science students,” he said.
Click to expand...

guest · Nov 28, 2019

mood said: ↑

This student hacked his school system to change his grades, but leaked other students' data
October 16, 2019
https://www.securitynewspaper.com/2...ge-his-grades-but-leaked-other-students-data/
Washington Post: Maryland student breaches computer security and steals data of nearly 1,350 teens
Click to expand...

Montgomery County Public Schools incident was bigger than initially thought
Naviance Data Breach - Updated Incident Information
November 25, 2019
https://www.montgomeryschoolsmd.org/index.aspx

MCPS is updating the guidance for a data security incident that occurred with Naviance. During further investigation of the incident impacting Naviance accounts at Wheaton High School, MCPS determined that the incident at Wheaton High School also has impacted students' Naviance accounts at five additional MCPS school.

Wheaton High School, Montgomery Blair High School, Julius West Middle School, Argyle Middle School, Parkland Middle School, and A. Mario Loiederman Middle School.
Click to expand...

Data Incident Response - UPDATED
(PDF): https://www.montgomeryschoolsmd.org/uploadedFiles/homepageContent/Naviance%20Data%20Incident%20Response-English-1.pdf

guest · Dec 6, 2019

IT vendor fined after data of 47,800 students, parents and staff of Singapore schools hacked
December 6, 2019
https://www.channelnewsasia.com/new...-fined-pdpc-hack-school-student-data-12160418

IT vendor Learnaholic has been fined S$60,000 after the personal data of more than 47,000 students, parents and staff of various schools were hacked.

The organisation provided services including attendance-taking and e-learning systems to schools in Singapore under a contract with the Ministry of Education.
However, lapses in its security arrangements led to the exposure of the personal data of about 47,802 students, students' parents and staff members of various schools, according to a decision published by the Personal Data Protection Commission (PDPC) on Thursday (Dec 5).

Because of these lapses, a hacker was able to steal the personal data of these individuals, including their names, NRIC numbers, contact numbers, e-mail and addresses.
Click to expand...

guest · Dec 26, 2019

The Naviance data breach: a lesson to MCPS
December 25, 2019
https://silverchips.mbhs.edu/content/the-naviance-data-breach-a-lesson-to-mcps-32451/

Montgomery County Public Schools (MCPS) has been eager to adopt the newest educational technologies, unveiling an initiative to introduce 40,000 laptops and tablets to students in 2014 and introducing myMCPS to the school system in 2017. But one thing is for sure: they are behind on preparing students for the moral dilemmas they now face.

Compared to the rate at which MCPS has been adopting the latest technologies, the county has been sorely lacking in providing the necessary ethics education to complement such growth. Technology has the power to do both good and harm, and without ethics classes, students do not always make the right choice.
If MCPS really wants to stay on top of the game by preparing students for the future, adding tech ethics to the list of graduation requirements is essential.

But why is tech ethics essential to life after high school? On the techie's side, it is about power and trust. Technologists have the power to do harm, but practice restraint because they are aware of the moral responsibility that comes with such power. On the consumer side, it is about awareness.
Click to expand...

This is responsible teaching. Let the Naviance data breach be a lesson to MCPS. Let this year's data breach be the last violation of the ethical limits of technology committed in MCPS by MCPS students.
Click to expand...

guest · Dec 30, 2019

School software vendor Active Network suffers data breach
December 30, 2019
https://www.scmagazine.com/home/sec...re-vendor-active-network-suffers-data-breach/

Acitve Network’s Blue Bear Software platform reported that unauthorized activity in its network earlier this year resulted in customer PII being exposed.

The company reported the issue to the California Attorney General’s office stating it recently became aware that between Oct. 1, 2019 and Nov. 13, 2019 there was illegal activity taking place on its Blue Bear platform during which time personal information was accessed or acquired by malicious actors.
Blue Bear makes software for public K-12 schools and school districts.

The information possibly accessed included name, payment card expiration date and security code and Blue Bear account usernames and passwords. The attackers did not access Social Security numbers, driver license numbers, or similar government ID card numbers.
Click to expand...

guest · Jan 8, 2020

Hong Kong schools urged to keep closer watch on computer systems after hacker attack on nine networks
January 7, 2020
https://sg.news.yahoo.com/hong-kong-schools-urged-keep-132319317.html

Hong Kong education authorities have urged schools to keep a closer watch on their computer systems for security breaches after hackers recently broke into a number of networks.

Of the nine schools involved in the cyberattack, the leakage of data – mainly personal information of pupils and staff – was found at four.
They were HKSKH Bishop Hall Secondary School, La Salle Primary School, Po Leung Kuk Ho Yuk Ching College and Islamic Kasim Tuet Memorial College.

The incident concerned WebSAMS, or web-based school administrative and management system, which the government developed to allow electronic communication between institutions and the authorities.
The system enables each school to handle large amounts of data [...] At present, 988 schools use the application and individual institutions are responsible for the daily operation and management of their WebSAMS.

“[It was confirmed] that the system of the school was attacked but no data leakage was observed. Immediate actions were taken … to stop the attack and to protect the system from being affected. A new version of WebSAMS was released on November 13, 2019 with an urgent notice strongly advising all schools to update their WebSAMS to the new version as soon as possible,” the paper said.
Click to expand...

guest · Jan 11, 2020

College Athlete Recruiting Software Exposed Students' Medical Info, Grades
January 8, 2020
https://www.vice.com/en_ca/article/...g-software-exposed-medical-information-grades

Front Rush, a technology company that provides services to college athletics programs, exposed a server containing more than 700,000 files to the open internet, including college athletes' medical records, performance reports, driver licenses, and other personal information.
Front Rush works with over 30,000 coaches and 9,500 teams according to its website. The company confirmed the data exposure in a statement.

"The privacy of our users' information is our top priority and we have extensive policies in place to protect that data. The bucket is closed and we will continue to monitor the server to ensure the highest security," a spokesperson wrote in an email, referring to the Amazon Web Services (AWS) server that was exposed.
Items exposed included students' SAT scores, personal address, date of birth, physical evaluations, post-injury reports, performance reviews from specific teams for particular players, and athletic financial aid agreements.
Click to expand...

guest · Feb 23, 2020

Handshake security breach affects thousands of university students
February 22, 2020
http://udreview.com/handshake-security-breach-affects-thousands-of-university-students/

Handshake, the university’s job search platform, experienced a security incident last week that directly affected over 8,000 students and alumni.

On Feb. 13, a number of students received a security alert from the university’s Career Center that an unknown party posing as a company on Handshake accessed student resumes. Resumes of 4,003 students and 4,026 alumni that were public on the website were downloaded by the unauthorized party according to Nathan Elton, director of the Career Center.

“We were surprised and deeply disappointed to learn that a public resume download of this magnitude was possible within Handshake’s system, and incredibly sorry for any impact it would have on our students and alumni,” Elton stated in an email.
Elton noted that the default setting for resumes uploaded to Handshake is set to private, with students or alumni having to “opt-in” to make resumes public to employers.

Potential employers looking to join Handshake are vetted through the platform’s “Employer Relations Team” and the university’s Career Center in a vigorous and multi-step process, Elton stated.
Even with these safeguards, the past few years have seen a number of internship scams from fraudulent companies recruiting through Handshake.
Click to expand...

About Handshake:

Let Handshake protect and secure your students
More than 900 career centers trust us to safeguard students throughout their career search
Students control their data
Simple, clear settings give students full control over which aspects of their profile are visible to your approved employers. They can also opt in and out at any time.
Click to expand...

guest · May 12, 2020

Aeries Student Information System discloses breach

Aeries student information system breached, unauthorized access to student and parent data, 166 hosted databases exposed https://aeries.com/notice-of-data-breach-4-27-2020… #edtech #k12cybersecure #databreach
— The K-12 Cybersecurity Resource Center (@K12CyberMap) May 1, 2020
Click to expand...

Aeries Software, Inc. - NOTICE OF DATA BREACH

The purpose of this notice is to inform you that your database may have been subject to unauthorized access involving your Parent and Student Data.

In late November 2019, Aeries Software became aware of unauthorized attempts to access data through the Aeries SIS. In response, we immediately began an investigation into whether these attempts had been successful and, if so, how they had been accomplished, what impact, if any, they may have had on data, and what steps we could take to thwart future unauthorized access to data through the Aeries SIS using the same or similar means. At the time, internal investigation did not reveal any compromise of the Aeries SIS or data.
[...]
According to the results of our investigation, there is evidence to suggest that your database in our Hosted environment may have been one of 166 databases subject to unauthorized access on or about November 4th, 2019. However, we understand the perpetrators have been taken into custody and the unauthorized access has been terminated.
Click to expand...

guest · Jun 4, 2020

mood said: ↑

Aeries Student Information System discloses breach

Aeries Software, Inc. - NOTICE OF DATA BREACH
Click to expand...

“Aeries Software” Breached and Over 150 School Districts Compromised
June 4, 2020
https://www.technadu.com/aeries-software-breached-over-150-school-districts-compromised/103869/

There’s a sudden wave of notifications of a breach reaching the parents of students of about 150 School Districts in the United States. Examples from the California office of data protection come from the San Bernardino City, the Yucaipa-Calimesa, and Rocklin. The common denominator in all of the cases is the use of the “Aeries” online student information system and online portal.

Apparently, Aeries discovered that someone gained unauthorized access to their systems back in November 2019, and accessed student and parent information stored there. Aeries clarified that the infiltrators exploited a bug in their systems that they have fixed now.
Along with the launching of an internal investigation and the informing of the law enforcement agencies, Aeries has circulated notices to the affected School Districts.

The announcements claim that the passwords are not retrievable or crackable, so there’s no danger of account takeovers. Still, every member had their password reset and provided a temporary password to access the Aeries platform and set a new password.
Click to expand...

Remember, this was not a mistake of your School District, but one that weighs Aeries.
Click to expand...

guest · Jun 17, 2020

San Beda student portal hacked, personal data of thousands stolen
June 7, 2020
https://www.rappler.com/nation/263117-san-beda-university-student-portal-hacked-personal-data-stolen

A still unidentified hacker has infiltrated the online student portal of San Beda University (SBU), gaining access to personal information and social media passwords of thousands of students and apparently releasing them online.

“We discovered an incident where your email address and password, as used in the student portal was accessed by an unknown entity, purporting to be a hacker, and illegally released the same publicly via social media platform Twitter,” SBU said in a statement to its community on Saturday, June 6.
The student portal is where SBU students view their grades and input their personal information for enrollment. Before the hack was confirmed, the student portal was defaced to flashing a threat from the hacker against SBU.
Click to expand...

How did it happen? SBU said the apparent hacker got through the system set up by the third-party company that SBU had hired for their student portal, Princtech Company.
According to its website, Princetech is a Philippine company founded in 2002 to provide information technology services to the business and academic communities, and business process outsourcing firms in the Philippines.
Click to expand...

guest · Jun 25, 2020

OneClass unsecured S3 bucket exposes PII on more than one million students, instructors
June 25, 2020
https://www.scmagazine.com/home/sec...n-more-than-one-million-students-instructors/

An unsecured database belonging remote learning platform OneClass has exposed information associated with more than a million students in North America who use the platform to access study guides and educational assistance.

“By not securing its users’ data, OneClass has created a goldmine for criminal hackers, jeopardizing the privacy and security of over a million young people and their families,” according to a report from researchers led by Noam Rotem and Ran Locar at vpnMentor.
Info exposed included full names, email addresses (some masked), schools and universities attended, phone numbers, school and university course enrollment details and OneClass account details.
Click to expand...

“The exposed database was built on an Elasticsearch framework and it was hosted on AWS, but left completely unsecured,” vpnMentor said. “It contained over 27 GB of data, totaling 8.9 million records, and exposed over one million individual OneClass users.”
Click to expand...

guest · Jul 29, 2020

mood said: ↑

College Athlete Recruiting Software Exposed Students' Medical Info, Grades
January 8, 2020
https://www.vice.com/en_ca/article/...g-software-exposed-medical-information-grades
Click to expand...

Athlete Recruiting Software Company Discloses Data Breach 7 Months after Student-Athlete Data is Exposed
July 29, 2020
https://hotforsecurity.bitdefender....er-student-athlete-data-is-exposed-23835.html

In January 2020, a security researcher discovered an exposed server belonging to Front Rush, an athlete-recruiting software company offering solutions to more than 9,500 college teams at over 850 institutions across the United States.

The initial report was kept low key, and it appears that the unsecured server contained over 700,000 files including medical records, performance reports, driver’s licenses and other personal identifiable information of college athletes.
Yesterday, however, Front Rush disclosed that it has started informing potentially affected individuals about the security incident that was overlooked 7 months ago.

According to the data breach notification, “on or around January 5, 2020, Front Rush was informed by a security researcher that one of its Amazon Web Services S3 buckets (“the S3 bucket”) was publicly accessible from the internet.”
Click to expand...

The company claims that, upon learning of the event, it immediately opened an investigation alongside third-party security experts. It appears that the S3 bucket housing the database was publicly accessible between January 18, 2016 and January 8, 2020.

While the report says there is “no evidence to suggest that the S3 bucket was accessed by anyone other than the security researcher, logs were not sufficient to show whether anyone else had accessed the data.”

“To date, Front Rush has not received any reports that personal information has been misused as a result of this incident,” the notification reads.
Click to expand...

guest · Aug 21, 2020

Jefferson Parish Schools data breach exposes 86 students' information
August 18, 2020
https://www.nola.com/news/education/article_2daf1d76-e194-11ea-ada1-634645bb8f57.html

A data breach that exposed 86 Jefferson Parish public school students’ confidential student portal log information to more than 40,000 families was caused by a problem with a vendor, a school system spokeswoman confirmed Tuesday.

When system officials began to receive calls about the problem, they contacted EdGear, the vendor that powers JCampus, a portal through which parents can view their students' grades and other information.
EdGear immediately shut the system down while they investigated what happened, Bristol said.

The data breach comes at a time when the system is already working through the technological challenges of enrolling nearly 19,000 students in its virtual program for the fall.
Click to expand...

guest · Sep 2, 2020

AusCERT says alleged DoE hack came from a third-party
AusCERT says a data breach occurred at K7Maths, a company providing services to schools
September 2, 2020
https://www.zdnet.com/article/auscert-says-alleged-doe-hack-came-from-a-third-party/

The Australian Computer Emergency Response Team (AusCERT) denied claims today that hackers had breached the Department of Education, Skills, and Employment (DoE), and downloaded the personal details of more than one million students, teachers, and staff.

Rumors of a supposed hack first surfaced yesterday after a hacker shared an archive file on a hacker forum, which they initially advertised as data obtained from the Australian DoE.
However, AusCERT says that such a hack never took place.
Click to expand...

In a statement posted on its website, AusCERT said that after analyzing the data with cyber-security firm Cosive, it determined that the leaked data originated from K7Maths, an online service providing school e-learning solutions.

"It's likely that the data came from an exposed Elasticsearch instance," AusCERT said, also adding that this was not a new leak, and had been previously shared online already, back in March 2020.
Per AusCERT, the leaked data contained details such as first names, emails, password strings, and K7Maths site settings.
Click to expand...

guest · Oct 30, 2020

OCSD, KCSD experience data security breach of student info
October 20, 2020
https://www.oskaloosa.com/knoxville...cle_a70d502c-1310-11eb-b3ab-c72b28ba609d.html

A contractor used by the Oskaloosa Community School District and the Knoxville Community School District has experienced a data security incident that resulted in a breach of personal student information.

Timberline Billing Services, Inc. provides Medicaid billing and reimbursement services to both districts, including more than 190 other schools in Iowa.
On Sept. 2, Timberline informed both districts that an “unknown actor” encrypted files and removed information from their networks from Feb. 12 through March 4, 2020. According to a press release, the breach did not involve access to their internal systems or student records.
Click to expand...

“Timberline’s review determined that the files contained some of our current and former students’ information, including names, dates of birth, Medicaid identification number and related billing information. Importantly, the files did not contain student social security numbers, credit card numbers or financial account information,” reads the press release.
According to the press release, Timberline is not aware of any misuse of the data as a result of the incident. services.
Click to expand...

College Community School District notifies current and former students of vendor's IT security incident

guest · Nov 12, 2020

Ransomware Attack on Medical Billing Company
November 11, 2020
https://www.infosecurity-magazine.com/news/ransomware-attack-on-medical/

An Iowa medical billing and reimbursements services company is boosting its cybersecurity after suffering a ransomware attack.

An unknown threat actor hit Timberline Billing Service LLC with malware between February 12 and March 4, 2020. After gaining access to the company's network, the attacker encrypted files and removed information.
Timberline said it was unable to determine precisely what data was exfiltrated, but a review of the files that could have been accessed concluded that current and former students in schools served by the company may have been impacted.

Timberline, which is based in Des Moines, provides services to around 190 schools in Iowa. The security incident was reported to the Department of Health and Human Services’ Office for Civil Rights as a data breach affecting up to 116,131 individuals.
Click to expand...

Data accessed by the attacker may have included students' names, dates of birth, Medicaid identification number, and related billing information.

Iowa City Community School District leaders said the ransomware attack "did not involve any access to District’s internal systems or student records."
Timberline started contacting students in Iowa on October 20 to notify them of “a privacy incident that may have involved some of their information.”
Click to expand...

guest · Oct 9, 2021

Data Hack Hits Alumni of Elite L.A. Private School
October 9, 2021
https://www.hollywoodreporter.com/l...i-harvard-westlake-private-school-1235028877/

Students’ confidential academic files were hacked and exposed at Los Angeles private school Harvard-Westlake. Archived SAT scores, GPAs, transcripts and college recommendation letters were downloaded, then sent to a group of parents and the school newspaper, as well as The Hollywood Reporter.

The materials encompass approximately 150 alumni who graduated over the past decade. They include the children of Oscar winners, media chieftains, household names, assorted billionaires and influential political donors of both major political parties.
Click to expand...

Harvard-Westlake’s president, Rick Commons, informed the school’s parents and alumni via e-mail on Sept. 3 that a data breach had occurred on the servers of Naviance, a third-party, cloud-based college-counseling platform the institution had used from 2012 through 2020. “The school is outraged by this violation of student privacy,” he wrote, adding that Harvard-Westlake had established an ad hoc committee to address the issue.

Following questions from THR, Commons sent another e-mail to the Harvard-Westlake community on Oct. 7, in which he explained that it’d been determined that an unknown entity had obtained the Naviance username and password of a senior school administrator — apparently the same one whose name was employed to later send the materials.
Click to expand...

While in recent years educational institutions across the country have faced a rising scourge of ransom-based hacks — in which money is demanded in exchange for stolen personal data — Harvard-Westlake believes it has ruled out such a motive. “This was not a ransomware attack,” says Ari Engelberg, the school’s head of communications and strategic initiatives.
Click to expand...

guest · Oct 29, 2021

Data security compromise included files accessed by cyber attacker
October 25, 2021
https://www.colorado.edu/today/2021...romise-included-files-accessed-cyber-attacker

Notifications are being distributed electronically this week to approximately 30,000 former and current CU affiliates regarding a data security compromise.
A vulnerability in software provided by a third-party vendor, Atlassian, impacted a program used mostly by the Office of Information Technology to share resources, such as support and procedural documents, configuration files and collaborative documents.

Some files stored in this program contained personally identifiable information for current and former students that included names, student ID numbers, addresses, dates of birth, phone numbers and genders. An analysis by the Office of Information Security revealed some data stored in the program was accessed by an attacker.
Affected individuals will be notified via email.
Click to expand...

OIT upgraded the software to the latest version which is not susceptible to the vulnerability that allowed the intrusion. OIT was testing the new version and preparing to implement it when the intrusion occurred.
Click to expand...

Data Breach at University of Colorado
https://www.infosecurity-magazine.com/news/data-breach-university-colorado/

An American university is notifying thousands of former and current students that their personal information may have been compromised during a recent data breach.

In a security notice issued October 25, the University of Colorado Boulder (CU Boulder) attributed the breach to an unpatched vulnerability in software provided by a third-party vendor, Atlassian Corporation Plc.
Click to expand...

guest · Nov 22, 2021

US education software company exposed personal data of 1.2M students
November 22, 2021
https://techcrunch.com/2021/11/22/smarterselect-exposed-millions-student-data/

SmarterSelect, a U.S.-based company that provides software for managing the application process for scholarships, exposed the personal data of thousands of applicants because of a misconfigured Google Cloud Storage bucket.

The data spill, discovered by cybersecurity company UpGuard, contained 1.5 terabytes of data collected by a number of programs that offer financial support to students. The data included documents such as academic transcripts, resumes and invoices for approximately 1.2 million applications to funding programs, dated from November 2020 to September 21, 2021. SmarterSelect’s website says it has served 1.6 million people to date.
Click to expand...

One folder hosted on the public bucket hosted 23,000 spreadsheets and 8,000 ZIP files, according to UpGuard’s analysis.
Some files also contained longer documents such as letters of recommendation and personal essays detailing poverty, physical and sexual abuse, domestic violence and other personal information, UpGuard said.

Another directory, which contained some 2.79 million files, included even more sensitive data on applicants.

“The contents of the bucket also serve as a reminder of the risks of collecting and retaining sensitive data, particularly for populations like college students,” UpGuard said. “The process of applying to, attending, and securing funding for university education requires young people to provide detailed information about themselves to a complex institutional supply chain.
Click to expand...

UpGuard: Student Applications: How an Education Software Company Leaked Millions of Files

UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs.
Click to expand...

guest · Nov 13, 2022

EdTech firm eKRÉTA that stores personal info of students breached by hacking group

https://riskybiznews.substack.com/i/83787544/breaches-and-hacks
Major breach in Hungary: A hacking group named Sawarim has breached eKRÉTA, the company behind a school management platform widely deployed across Hungary. The platform is believed to store the personal details of more than 720,000 Hungarian students, aged between 6 and 18 years.

While the hackers told a local news outlet they don't plan to release any of the students' personal details, they have already begun leaking some of the software company's source code, internal chats, and email messages, including with state officials.
Click to expand...

Log in or Sign up

Data breach of third-party vendor puts personal info of students at risk

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Data breach of third-party vendor puts personal info of students at risk

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches