According to vpnMentor, the data of approximately one million students of the e-Learning platform, OneClass, has been leaked.
The platform , based in Toronto, provides study guides and other educational materials to over 600,000 students in North America.
In May, vpnMentor discovered an Elasticsearch database hosted on Amazon Web Services (AWS) that was completely exposed and could be viewed by anyone with internet access
The database was found to contain a total of 8,972,251 records representing information on more than 1 million individuals. The data includes identifying information and educational records.
However, in addition to information about the platform's members, the database also included information about people who had applied but were unable to become members of the platform.
Security researchers discovered the exposed database on May 20 and contacted the vendor on May 25, and it was secured the next day.
According to OneClass, this was a test and the data contained in the database "did not relate to real people.".
"However, during our investigation, we used publicly available information to verify a small sample of records in the database. By taking PII data from many records, we found social media of teachers and other users across various platforms that matched records in the OneClass database," vpnMentor.
The data in the database included PII such as full names and phone numbers, email addresses, information about schools and universities, school/university course registration details, and other information related to the OneClass account.
In some cases, additional information about students and courses was stored, such as faculty details and access to protected textbooks and exercises. Most of the data on OneClass is free, but there is also content only for paying users
As vpnMentor explained, the exposed information could be very useful to malicious actors, assuming the database was discovered by hackers while it was exposed.
