Data breach at school accreditation organization exposes student, parent and teacher records

A non-password-protected database belonging to the Southern Association of Independent Schools, Inc (SAIS) was recently exposed in a data breach online.

According to cybersecurity researcher Jeremiah Fowler, the database contains some of the most “sensitive data collections” he has ever discovered, including teacher and student records, health information, active shooter and lockdown notifications, maps of schools, financial budgets and more.

A total of 512 GB of data, or 682,438 records spanning from 2012 to 2023, were leaking online in formats such as PDF, Excel, PPTX, doc, docx, png, jpg and pages.

Here’s a breakdown of the exposed data, according to the researcher:

• Personally identifiable information (PII) of teachers and students
• Health information including medical history, allergies and immunization records
• Teacher background checks, salary information and interview details and Social Security Numbers, drug and alcohol testing
• Budget reports, vehicle registrations, insurance policies, tax records, training documents
• Contact details of parents or guardians and emergency notifications
• Information about the school’s facilities, safety protocols, emergency response plans, building codes and health department regulations
• Miscellaneous documents such as manuals, guides and certificates

“Of particular concern were confidential third-party security reports, assessing weaknesses in school security, camera locations, access points, and other vital information that could pose a real-world security risk to students and faculty,” Fowler explained.

In his report, Fowler emphasized the risks for students and faculty members if the data gets into the wrong hands.

“The exposed data presented a host of potential risks, ranging from straightforward extortion to more sophisticated identity theft and financial crimes,” the report reads. “Criminals with access to such sensitive records could exploit the information for fraudulent activities, including obtaining loans or credit in the name of educational institutions.

Additionally, the leaked emergency response plans and school security details could be used by malicious actors to plan attacks on schools, endangering the safety of students and staff.”

Worried about how data breaches can impact your privacy and security?

Bitdefender’s Digital Identity Protection automatically searches for leaked personal data online (including on the Dark Web), sending you real-time alerts when your private information has been exposed. You get real-time data breach alerts and an easy way to monitor and assess your risk levels.

If you worry about cybercriminals abusing your identity and financial information, check out our new Bitdefender Identity Theft Protection plans (US only) that offer real-time data breach monitoring, fraud monitoring, stolen wallet assistance, restoration services, and up to $2 million in identity theft insurance to help you cover legal fees and other costs for fixing your identity, depending on your chosen plan.

Read more about our identity protection and privacy solutions here.