Data breach at Bank Street College of Education exposes sensitive information of thousands

A major data exposure incident has come to light involving Bank Street College of Education, a renowned private institution based in New York City. According to cybersecurity researchers at Cybernews, a misconfigured Amazon Web Services (AWS) storage bucket linked to the school inadvertently revealed personal details of hundreds of thousands of individuals.

The researchers discovered that the exposed cloud instance contained over half a million files, the majority of which appeared to be resumes and CVs. Each file likely corresponds to a unique individual and included highly sensitive personal information such as full names, home addresses, phone numbers, email addresses, and educational and professional histories.

The bucket, left accessible to the public for at least a month, posed a significant security risk, making the data vulnerable to cybercriminals who use automated bots to scan the internet for such unprotected instances. The exposed documents dated from 2014 to 2022, increasing the potential impact and reach of the breach.

Although no evidence has yet been found indicating misuse of the data, cybersecurity experts warn that the exposed information could be exploited in several harmful ways. The combination of personal identifiers and educational records could allow attackers to launch targeted phishing campaigns, create fraudulent academic credentials, or impersonate faculty and students to gain unauthorized access to school services.

The researchers expressed particular concern over the potential for identity theft and doxxing. They noted that threat actors could easily craft convincing phishing emails, scam text messages, or fraudulent academic and employment communications. Such messages might request additional sensitive data, including identification scans or banking information. The leaked contact details could also be used for voice phishing schemes, in which scammers pose as school officials or financial institutions, tricking individuals into paying fictitious tuition fees or loan repayments. Cybernews has reached out to Bank Street College of Education for comment. As of now, no official response has been provided.