Graduation photo maker exposes thousands of students' data

A recent investigation by the Cybernews research team has unveiled a significant data breach involving a US-based graduation photo maker, Digital Pix & Composites. The company inadvertently exposed the personal details of thousands of students from numerous American universities.

The breach was discovered through an open Microsoft Azure Blob, an online storage service housing hundreds of text files containing sensitive information. According to the research team, the exposed data includes full names, home addresses, and educational affiliations of approximately 43,000 students from 222 universities across the United States.

The leak affected prominent institutions such as Stanford, the University of California, the University of Michigan, and the University of Texas. Despite the researchers’ efforts to notify Digital Pix & Composites about the breach in late November 2023, the company allegedly took no action, leaving the data accessible to the public.

The exposed personal data poses significant privacy risks to the affected students. Cybercriminals could potentially exploit this information for malicious purposes, including spear phishing attacks and social engineering schemes to compromise individuals’ security or obtain further sensitive data.

Furthermore, the leakage of home addresses raises concerns about potential physical threats, such as doxxing or targeted criminal activities.

Researchers have provided recommendations to mitigate future incidents in response to the breach. These include retrospectively monitoring access logs, updating permissions and access controls, conducting audits of access controls, and enhancing monitoring and logging mechanisms to detect suspicious activities promptly. Efforts to contact Digital Pix & Composites for comment on the matter were unsuccessful at the time of publishing.