Mumbai: An independent cybersecurity research publication, Cybernews.com, revealed that one of India’s topmost study abroad platforms, Leverage Edu allegedly saw 240,000 sensitive files, including student passports, financial documents, certificates, and exam results go public for a temporary period due to misconfiguration of their systems.
According to the investigation conducted by the Cybernews research team, the latter found a ‘misconfigured and publicly accessible’ cloud storage – an Amazon S3 bucket, which stores and retrieves any amount of data.
Zip folders consisted of data of students, says report
The bucket reportedly had thousands of zip folders, which revealed information about students’ degree certificates, report cards, CVs, application forms, bank statements, passport photos, loan documents, and more.
“A malicious actor could have exploited the leaked personal data to commit identity theft and fraud. A data leak of such magnitude creates an opportunity for criminals to craft spear-phishing attacks and target individuals with greater precision putting their financial and other accounts at risk,” said the report.
Leverage Edu denies breach, leak of data
The Free Press Journal reached out to Leverage Edu regarding the allegations. The company highlighted that there was ‘no breach or leak to any malicious party and the link was public only for a short while.’
“The link in question was being used by our bank partners to access documents of students who had requested an education loan and given permission for their documents to be shared and was created / open at their end, aka third parties. This link became public for a very short while when the system was being migrated to a newer and safer system. The migration has been completed since then and our students' data is safe,” a spokesperson from Leverage Edu told The FPJ.
While signifying its commitment towards cybersecurity, the official stated that the company is also taking measures to ensure data remains ‘absolutely secure.’
“We take cybersecurity very seriously at Leverage Edu. In addition to our current measures, we have also engaged a top cybersecurity consulting firm to audit and monitor our technology systems on an ongoing basis to ensure our data remains absolutely secure. We were able to fix this isolated issue in time before any data leak or misuse could happen,” the spokesperson added.
Leverage Edu, which was founded by Akshay Chaturvedi in 2017, caters to students from India, Nigeria, Nepal, and many more countries where many individuals dream to study abroad.
