Security

Schoolzilla Security Issue Exposes Data for 1.3 Million Students and Staff

• By Sri Ravipati
• 04/21/17

Students, parents, teachers, administrators and others using the Schoolzilla data platform were recently informed of a security issue that made information for more than 1.3 million users vulnerable to hackers.

The issue was uncovered by Chris Vickery, a white-hat computer security researcher best known for discovering an exposed database containing more than 191 million American voter registration records. Vickery currently runs the Security Watch blog for MacKeeper, an anti-virus software firm, and leads MacKeeper’s Analytical and Security Center.

In a recent Security Watch blog post, Vickery said that he discovered a file configuration error in an analysis of Schoolzilla, which “made the all too common mistake of configuring their cloud storage (an Amazon S3 bucket) for public access. I discovered the bucket after noticing a few other unsecured buckets related to the Tableau data visualization platform.” He found an exposed bucket called “sz.tableau” and began looking for other “sz” iterations, only to find a repository for Schoolzilla’s database backups.

“I downloaded several of the production backups, the largest was titled ‘Web_Data_FULL’ and weighed in at 12 gigs,” he wrote. “After loading them into a local MSSQL instance I did some review and concluded that this was most likely real student data and did indeed come from Schoolzilla.”

Vickery wrote that the company was quick to respond to his data breach notification ticket — and without shooting the messenger or accusing Vickery of being hacker. Within a few days, the CEO personally contacted each client to relay the news.

In a Schoolzilla blog post, CEO and founder Lynzi Ziegenhagen said, “As soon as we learned of it, we immediately fixed the error and confirmed no one accessed any information, other than the researcher. We are grateful that the researcher informed us quickly, so we were able to fix it quickly. Once resolved, we spent the next two days calling each of our customers personally and explaining the technical safeguards that will prevent this from happening again.”

In response to the security breach, Schoolzilla has launched a forum “for lessons learned, best practices and advice from experts” on information security and how “to serve students better with data.”

View the message from the CEO on the Schoolzilla site.