238,000 Records Exposed: The UStrive Data Security Lapse Crisis
UStrive, an online mentoring platform, recently fixed a security lapse that exposed over 238,000 student records, including names and phone numbers, through a vulnerable GraphQL endpoint.
A platform built to guide the next generation just left their digital front door wide open. UStrive, a non-profit mentoring site for students, recently patched a security flaw that exposed the personal data of hundreds of thousands of users. This wasn't a sophisticated hack; it was a fundamental failure that allowed any logged-in user to see the private details of others.
Inside the UStrive Data Security Lapse
According to reports from TechCrunch, the vulnerability was found in a vulnerable Amazon-hosted GraphQL endpoint. By simply monitoring network traffic while browsing the site, anyone with an account could access reams of non-public data. At least 238,000 user records were confirmed to be at risk during the discovery phase.
- Full names, email addresses, and phone numbers were fully visible.
- Sensitive demographics like gender and date of birth were leaked for many students.
- The platform claims to serve over 1.1 million students, making the potential scale even larger.
Silence and Legal Shields
The company's reaction has been tight-lipped. UStrive's attorney stated they're currently in litigation with a former software engineer, which has limited their ability to respond. While CTO Dwamian Mcleish confirmed the issue has been "remediated," the non-profit hasn't committed to notifying the affected parents and students. It's still unclear if any malicious actors exploited the flaw before it was fixed.
Authors
Related Articles
UK Visa Portal, a private immigration service mistaken for an official government site, has been exposing passport scans and selfies of over 100,000 applicants. The breach remains unpatched.
Okta CEO Todd McKinnon on why AI agents need identity management, the SaaSpocalypse threat, and why the kill switch might be the most important button in enterprise tech.
Iran and Israel are hacking civilian security cameras for military reconnaissance. How consumer surveillance devices became weapons of war.
A security researcher discovered he could access 7,000 DJI robot vacuums and peek into strangers' homes. This Valentine's Day revelation exposes the hidden privacy risks of our smart home obsession.
UK Visa Portal, a private immigration service mistaken for an official government site, has been exposing passport scans and selfies of over 100,000 applicants. The breach remains unpatched.
Okta CEO Todd McKinnon on why AI agents need identity management, the SaaSpocalypse threat, and why the kill switch might be the most important button in enterprise tech.
Iran and Israel are hacking civilian security cameras for military reconnaissance. How consumer surveillance devices became weapons of war.
A security researcher discovered he could access 7,000 DJI robot vacuums and peek into strangers' homes. This Valentine's Day revelation exposes the hidden privacy risks of our smart home obsession.
Thoughts
Share your thoughts on this article
Sign in to join the conversation