Skip to content
RealinfoSec.net

RealinfoSec.net

InfoSec News, Cybersecurity Awareness

  • Home
  • InfoSec News
    • Data Breach News
    • Latest Vulnerabilities
  • What Is InfoSec
  • CyberSecurity Newsletter
  • Cyber Academy
  • Cyber Help Desk
  • Cyber Knowledge Base
  • Contact Us
    • Contribute
  • My Bookmarks
  • Subscribers
    • Knowledge Quizzes
    • Register
  • Login
    • Password Reset
  • Register
  • Privacy Policy
    • Legal
  • Toggle search form
data breach

100,000 students’ grades and personal information were leaked via McGraw Hill’s S3 buckets

Posted on 20 December 202220 December 2022 By RiSec.Mitch No Comments on 100,000 students’ grades and personal information were leaked via McGraw Hill’s S3 buckets

According to security researchers, McGraw Hill’s misconfigured Amazon Web Services S3 buckets exposed more than 100,000 students’ records in addition to its own source code and cryptographic keys.

The research group at vpnMentor claimed to have found the open S3 buckets on June 12 and to have gotten in touch with McGraw Hill the following day. We’re informed that two buckets, one for production and the other for non-production, each held more than 69 million files and 10 TB of data.

“In the limited sample we researched, we could see that the amount of records varied on each file from ten to tens of thousands students per file,” the researchers said. “Due to the amount of files exposed and because we only review a small sample following ethical rules, the actual total number of affected students could be far higher than our estimate.”

Overall, the buckets contained more than 22 TB of data and over 117 million files. It included students’ names, email addresses, performance reports and grades as well as teachers’ syllabi and course reading materials for US and Canadian students and schools such as Johns Hopkins University, University of California-Los Angeles, University of Toronto and University of Michigan. 

Additionally, the data dump leaked private digital keys, which could have allowed miscreants to decrypt the publisher’s sensitive data and access its servers, plus McGraw Hill’s source code. 

The misconfigured S3 buckets could have been accessed by anyone with a web browser as far back as 2015, we’re told. 

The researcher added that they used publicly accessible data to validate a “small sample” of the records and compared students’ social media profiles to the PII in McGraw Hill’s open buckets to prove the data belonged to actual people rather than just a platform test.

Recommended:  5+ Things to teach your kids about Social Media

vpnMentor asserts that between June 13 and July 4, including reaching out to various departments and the chief information security officer, it contacted McGraw Hill nine times but never received a response after confirming that the data belonged to the company’s online learning platform.

Furthermore, the network security company claimed that between June 27 and July 4 it contacted the United States Computer Emergency Response Team (US-CERT) four times but received no response from them either.

Finally, according to the report, on September 21, McGraw Hill’s senior director of cybersecurity informed vpnMentor that the sensitive files had been taken down from the public pool on July 20.

“We are unable to determine if any malicious hackers found the unsecured buckets before McGraw Hill deleted the sensitive files,” the researchers wrote, adding that the exposed data could have been used for phishing campaigns and identity theft as well as doxxing and harassment.

Plus, we’d guess that the publishing firm’s source code and private keys would be appealing to ransomware gangs, who have a certain affinity for education-sector organizations and schools, or even less sophisticated criminals looking to make a buck or two on the darkweb.

“Furthermore, under US Federal law, student education records are official and confidential documents, by virtue of the Family Educational Rights and Privacy Act (FERPA),” the researchers noted. “A student’s grades may not be released or posted in any personally identifiable way without prior written permission from the student. As a result, by exposing these records, McGraw Hill may be in direct violation of FERPA, and could face enforcement actions from the relevant US government bodies.”

Recommended:  Apple pays out $100k bounty for Safari webcam hack that imperilled victims’ online accounts

Not to name names, but a certain US watchdog agency (cough) Federal Trade Commission (cough) doesn’t take too kindly to leaks involving students’ data.

McGraw Hill did not respond to inquiries for this story.

Suggest an edit to this article

Cybersecurity Knowledge Base

Homepage

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark

Please login to bookmark

Social Comments Box
  • About
  • Latest Posts
RiSec.Mitch
Just your average information security researcher from Delaware US.
Latest posts by RiSec.Mitch (see all)
  • Google Open-Source Vulnerability Scanning Tool - 18 January 2023
  • Polymorphic Malware Produced by ChatGPT - 18 January 2023
  • Russian Hackers Repurpose Decade-Old Malware Infrastructure to Deploy New Backdoors - 8 January 2023
Share the word, let's increase Cybersecurity Awareness as we know it

No related articles.

Data Breach News, InfoSec News Tags:breach, McGraw Hill's, S3 Buckets

Post navigation

Previous Post: Swatters live-streamed attacks and mocked police using Ring cameras
Next Post: Apple is accused of censoring apps in Hong Kong and Russia

Related Posts

FBI Logo FBI Arrests Former NSA Employee For Trying to Sell Top Secret Documents InfoSec News
CVE OpenSSL fixed two high-severity vulnerabilities InfoSec News
DDoS Google mitigates largest DDoS Attack in History – Peaked at 46 Million RPS Featured
Rockstar confirms hack after Grand Theft Auto 6 leak Data Breach News
Inadvertently, a researcher crashes the KmsdBot Cryptocurrency mining Botnet InfoSec News
LibreOffice LibreOffice Security Update Fixes Macro Execution Bypass and Potential Password Leaking InfoSec News

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

RiSec Captcha + 56 = 60

AbuseIPDB Contributor Badge

Follow Our Socials:

Latest InfoSec News

Data Breach News InfoSec News

JD Sports: Cyber Attack affects 10 million customers

RiSec.n0tst3
30 January 2023 0
what is infosec
Cybersecurity Academy

InfoSec – A Newbie Guide – InfoSecurity

RiSec.n0tst3
25 January 2023 0
google
Cybersecurity Academy How to

Google Open-Source Vulnerability Scanning Tool

RiSec.Mitch
18 January 2023 0
InfoSec News

Polymorphic Malware Produced by ChatGPT

RiSec.Mitch
18 January 2023 0
russia
InfoSec News

Russian Hackers Repurpose Decade-Old Malware Infrastructure to Deploy New Backdoors

RiSec.Mitch
8 January 2023 0
latest cybersecurity news
InfoSec News

Dridex Banking Malware Targets MacOS users with a new delivery method

RiSec.Mitch
8 January 2023 0
ransomware
InfoSec News

Microsoft Discloses Methods Employed by 4 Ransomware Families Aiming at macOS

RiSec.Mitch
8 January 2023 0
InfoSec News

$8 billion in cryptocurrency withdrawals strike US bank Silvergate

RiSec.Mitch
8 January 2023 0

Featured Posts

cve-2022-38970
Data Security Featured How to InfoSec News Vulnerabilities

ieGeek Security Vulnerabilities still prevalent in 2022 IG20

RiSec.n0tst3
28 August 2022 6
Data Security Featured InfoSec News

Hacking Campaign Steals 10,000 Login Credentials From 130 Different Organizations

RiSec.n0tst3
27 August 2022 0
DDoS
Featured InfoSec News

Google mitigates largest DDoS Attack in History – Peaked at 46 Million RPS

RiSec.n0tst3
19 August 2022 1
Security researcher contacted me
Cybersecurity Academy Featured How to

A Security Researcher Contacted Me – What should I do?

RiSec.n0tst3
30 June 2022 0
google chrome
Featured InfoSec News

Google Chrome extensions can be easily fingerprinted to track you online

RiSec.n0tst3
19 June 2022 0
MFA
Cybersecurity Academy Data Security Featured

3 Steps To Better Account Security

RiSec.n0tst3
21 February 2022 0
hardening vps security
Cybersecurity Academy Featured

HARDEN YOUR VPS: Steps to Hardening your VPS Security

RiSec.n0tst3
10 January 2022 2

Share the joy

Copyright © 2022 RealinfoSec.net. CyberSecurity News & Awareness. All Trademarks, Logos And Brand Names Are The Property Of Their Respective Owners

We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of the cookies. Cookie & Privacy Policy
Cookie settingsACCEPT
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Non-necessary
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
SAVE & ACCEPT
en English
af Afrikaanssq Albanianam Amharicar Arabichy Armenianaz Azerbaijanieu Basquebe Belarusianbn Bengalibs Bosnianbg Bulgarianca Catalanceb Cebuanony Chichewazh-CN Chinese (Simplified)zh-TW Chinese (Traditional)co Corsicanhr Croatiancs Czechda Danishnl Dutchen Englisheo Esperantoet Estoniantl Filipinofi Finnishfr Frenchfy Frisiangl Galicianka Georgiande Germanel Greekgu Gujaratiht Haitian Creoleha Hausahaw Hawaiianiw Hebrewhi Hindihmn Hmonghu Hungarianis Icelandicig Igboid Indonesianga Irishit Italianja Japanesejw Javanesekn Kannadakk Kazakhkm Khmerko Koreanku Kurdish (Kurmanji)ky Kyrgyzlo Laola Latinlv Latvianlt Lithuanianlb Luxembourgishmk Macedonianmg Malagasyms Malayml Malayalammt Maltesemi Maorimr Marathimn Mongolianmy Myanmar (Burmese)ne Nepalino Norwegianps Pashtofa Persianpl Polishpt Portuguesepa Punjabiro Romanianru Russiansm Samoangd Scottish Gaelicsr Serbianst Sesothosn Shonasd Sindhisi Sinhalask Slovaksl Slovenianso Somalies Spanishsu Sudanesesw Swahilisv Swedishtg Tajikta Tamilte Teluguth Thaitr Turkishuk Ukrainianur Urduuz Uzbekvi Vietnamesecy Welshxh Xhosayi Yiddishyo Yorubazu Zulu