According to security researchers, McGraw Hill’s misconfigured Amazon Web Services S3 buckets exposed more than 100,000 students’ records in addition to its own source code and cryptographic keys.
The research group at vpnMentor claimed to have found the open S3 buckets on June 12 and to have gotten in touch with McGraw Hill the following day. We’re informed that two buckets, one for production and the other for non-production, each held more than 69 million files and 10 TB of data.
“In the limited sample we researched, we could see that the amount of records varied on each file from ten to tens of thousands students per file,” the researchers said. “Due to the amount of files exposed and because we only review a small sample following ethical rules, the actual total number of affected students could be far higher than our estimate.”
Overall, the buckets contained more than 22 TB of data and over 117 million files. It included students’ names, email addresses, performance reports and grades as well as teachers’ syllabi and course reading materials for US and Canadian students and schools such as Johns Hopkins University, University of California-Los Angeles, University of Toronto and University of Michigan.
Additionally, the data dump leaked private digital keys, which could have allowed miscreants to decrypt the publisher’s sensitive data and access its servers, plus McGraw Hill’s source code.
The misconfigured S3 buckets could have been accessed by anyone with a web browser as far back as 2015, we’re told.
The researcher added that they used publicly accessible data to validate a “small sample” of the records and compared students’ social media profiles to the PII in McGraw Hill’s open buckets to prove the data belonged to actual people rather than just a platform test.
vpnMentor asserts that between June 13 and July 4, including reaching out to various departments and the chief information security officer, it contacted McGraw Hill nine times but never received a response after confirming that the data belonged to the company’s online learning platform.
Furthermore, the network security company claimed that between June 27 and July 4 it contacted the United States Computer Emergency Response Team (US-CERT) four times but received no response from them either.
Finally, according to the report, on September 21, McGraw Hill’s senior director of cybersecurity informed vpnMentor that the sensitive files had been taken down from the public pool on July 20.
“We are unable to determine if any malicious hackers found the unsecured buckets before McGraw Hill deleted the sensitive files,” the researchers wrote, adding that the exposed data could have been used for phishing campaigns and identity theft as well as doxxing and harassment.
Plus, we’d guess that the publishing firm’s source code and private keys would be appealing to ransomware gangs, who have a certain affinity for education-sector organizations and schools, or even less sophisticated criminals looking to make a buck or two on the darkweb.
“Furthermore, under US Federal law, student education records are official and confidential documents, by virtue of the Family Educational Rights and Privacy Act (FERPA),” the researchers noted. “A student’s grades may not be released or posted in any personally identifiable way without prior written permission from the student. As a result, by exposing these records, McGraw Hill may be in direct violation of FERPA, and could face enforcement actions from the relevant US government bodies.”
Not to name names, but a certain US watchdog agency (cough) Federal Trade Commission (cough) doesn’t take too kindly to leaks involving students’ data.
McGraw Hill did not respond to inquiries for this story.
Suggest an edit to this article
Remember, CyberSecurity Starts With You!
- Globally, 30,000 websites are hacked daily.
- 64% of companies worldwide have experienced at least one form of a cyber attack.
- There were 20M breached records in March 2021.
- In 2020, ransomware cases grew by 150%.
- Email is responsible for around 94% of all malware.
- Every 39 seconds, there is a new attack somewhere on the web.
- An average of around 24,000 malicious mobile apps are blocked daily on the internet.
- Voice ID: How Secure is it Really? - 2 March 2023
- Enterprise users infected by RIG Exploit Kit thanks to Internet Explorer - 27 February 2023
- Google Open-Source Vulnerability Scanning Tool - 18 February 2023