Data Leak Exposes 572 GB of Student, Faculty Info from Accreditation Org

IN SUMMARY

• It was a database misconfiguration-related data leak.
• The sensitive information spanned from 2012 to 2023.
• The data leak contained 512 GB of data, with 682,438 records.
• The database was open to public access without any password.

Cybersecurity researcher Jeremiah Fowler has revealed a significant data breach that has raised serious concerns about the security of sensitive information in the education sector. Fowler stumbled upon an unprotected database containing a staggering 682,438 records related to educational institutions.

The exposed data belonged to the Southern Association of Independent Schools, Inc (SAIS), a prominent non-profit organization providing support to schools and educators across the United States and several other countries.

The Scope of the Breach:

The data leak contained a vast array of sensitive information, spanning from 2012 to 2023, making it a treasure trove for potential cyber criminals. The compromised documents encompassed multiple categories, including student and teacher records, health information, social security numbers (SSN), active shooter and lockdown notifications, school maps, financial budgets, and more.

Of particular concern were confidential third-party security reports, assessing weaknesses in school security, camera locations, access points, and other vital information that could pose a real-world security risk to students and faculty.

Documents in the leaked data (Image: Jeremiah Fowler – Website Planet)

Sensitive Records Exposed:

The sheer volume of data in the breached database totalled an astounding 572.8 GB, comprising various file formats, such as PDF, Excel, PPTX, doc, docx, png, jpg, and pages.

According to Fowler’s blog post, among the exposed records, were personally identifiable information (PII) and private medical information of students, teacher background checks, salary details, and interview information. Moreover, the breach revealed budgets, financial reports, vehicle registrations, insurance policies, tax records, training documents, and numerous other miscellaneous files.

Potential Risks and Implications:

The exposed data presented a host of potential risks, ranging from straightforward extortion to more sophisticated identity theft and financial crimes. Criminals with access to such sensitive records could exploit the information for fraudulent activities, including obtaining loans or credit in the name of educational institutions.

Additionally, the leaked emergency response plans and school security details could be used by malicious actors to plan attacks on schools, endangering the safety of students and staff.

Recommended Measures for Enhanced Security:

To mitigate future risks, schools, educational organizations, and accreditation bodies must prioritize implementing basic security protocols, such as firewalls, encryption, and multi-factor authentication.

Furthermore, conducting regular staff training on cybersecurity best practices and establishing comprehensive incident response plans can better address and manage data breaches, should they occur.

SAIS’s Response and Data Protection Compliance:

Upon receiving the responsible disclosure notification from Jeremiah Fowler, SAIS acted swiftly to secure the exposed database and expressed gratitude for the researcher’s timely warning. However, it remains unclear whether the potentially affected individuals or relevant authorities were promptly notified of the data exposure.

It is essential for educational institutions to adhere to data protection laws, including the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA), to safeguard sensitive information and uphold the privacy of students, teachers, and parents.

RELATED ARTICLES

1. 100s of schools at risk after Magecart attack on Wisepay
2. 13-year-old student arrested for hacking school computers
3. School hackers steal data of half a million students and staff
4. Malware found in UK Govt-funded laptops for homeschoolers
5. Iranian APT group hits schools, universities in phishing attacks

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.