Schoolzilla Security Issue Exposes Data for 1.3 Million Students and Staff

Students, parents, teachers, administrators and others using the Schoolzilla data platform were recently informed of a security issue that made information for more than 1.3 million users vulnerable to hackers.

The issue was uncovered by Chris Vickery, a white-hat computer security researcher best known for discovering an exposed database containing more than 191 million American voter registration records. Vickery currently runs the Security Watch blog for MacKeeper, an anti-virus software firm, and leads MacKeeper’s Analytical and Security Center.

In a recent Security Watch blog post, Vickery said that he discovered a file configuration error in an analysis of Schoolzilla, which “made the all too common mistake of configuring their cloud storage (an Amazon S3 bucket) for public access. I discovered the bucket after noticing a few other unsecured buckets related to the Tableau data visualization platform.” He found an exposed bucket called “sz.tableau” and began looking for other “sz” iterations, only to find a repository for Schoolzilla’s database backups.

“I downloaded several of the production backups, the largest was titled ‘Web_Data_FULL’ and weighed in at 12 gigs,” he wrote. “After loading them into a local MSSQL instance I did some review and concluded that this was most likely real student data and did indeed come from Schoolzilla.”

Vickery wrote that the company was quick to respond to his data breach notification ticket — and without shooting the messenger or accusing Vickery of being hacker. Within a few days, the CEO personally contacted each client to relay the news.

In a Schoolzilla blog post, CEO and founder Lynzi Ziegenhagen said, “As soon as we learned of it, we immediately fixed the error and confirmed no one accessed any information, other than the researcher. We are grateful that the researcher informed us quickly, so we were able to fix it quickly. Once resolved, we spent the next two days calling each of our customers personally and explaining the technical safeguards that will prevent this from happening again.”

In response to the security breach, Schoolzilla has launched a forum “for lessons learned, best practices and advice from experts” on information security and how “to serve students better with data.”

View the message from the CEO on the Schoolzilla site.

About the Author

Sri Ravipati is Web producer for THE Journal and Campus Technology. She can be reached at [email protected].

Featured

  • DreamBox Math

    Discovery Education Announces Updates to Experience, DreamBox Math

    K-12 learning solution provider Discovery Education has announced enhancements to its Discovery Education Experience and DreamBox Math products, designed to create a more personalized, engaging learning experience for students.

  • abstract pattern of cybersecurity, ai and cloud imagery

    Report Identifies Malicious Use of AI in Cloud-Based Cyber Threats

    A recent report from OpenAI identifies the misuse of artificial intelligence in cybercrime, social engineering, and influence operations, particularly those targeting or operating through cloud infrastructure. In "Disrupting Malicious Uses of AI: June 2025," the company outlines how threat actors are weaponizing large language models for malicious ends — and how OpenAI is pushing back.

  • digital dashboard featuring a shield icon, graphs, a world map, and network nodes

    IBM Launches Agentic AI Governance and Security Platform

    IBM has introduced a new software stack for enterprise IT teams tasked with managing the complex governance and security challenges posed by autonomous AI systems.

  • laptop and fish hook

    Security Researchers Identify Generative AI 'Vishing' Attack

    A new report from researchers at Ontinue's Cyber Defense Center has identified a complex, multi-stage cyber attack that leveraged social engineering, remote access tools, and signed binaries to infiltrate and persist within a target network.