This post is also available in: heעברית (Hebrew)

Close to a million files containing sensitive private information of minors were left completely exposed to anyone on the internet, thus posing a threat to the children.

The IT company ‘Appscook’ develops applications used by more than 600 schools in India and Sri Lanka for education management. A research team from Cybernews recently discovered that the company leaked a staggering amount of sensitive data that included photos of minors, home addresses, and birth certificates, due to a misconfiguration of their systems.

The DigitalOcean storage bucket that contains almost a million sensitive files was left open with no required authentication. The leaked private data in this instance has posed a grave risk to minors.

According to Cybernews, the exposed data contained the following information: the names of students and their parents, pictures of students attending pre-primary, primary, and secondary schools, names of the schools children attend, birth certificates, fee receipts, student report cards/exam results, home addresses and phone numbers.

This leak is dangerous and raises serious concerns regarding the potential of cybercriminals misusing this personal information and paints a disturbing scenario where malicious actors could exploit the vulnerability of children by attempting to extort their parents.

Vincentas Baubonis, Information Security Researcher at Cybernews, has stated: “The leaked data about minors could have dire consequences, as this information can put children at physical risk by revealing their daily whereabouts. It can also be used by someone with malicious intent to impersonate school officials or manipulate children and parents.”

Threat actors could exploit the leaked personal data for identity theft, fraud, and targeted phishing campaigns against the parents of these children. In a worst-case scenario, the leak might increase the risk of child abuse, as researchers warn that sharing children’s images can lead to unwanted attention, including from predators.