The target: CU Boulder, a U.S based University.
The take: Exposure of support and procedural documents, configuration files, and personally identifiable information of 30,000 students including: names, student IDs, addresses, dates of birth, phone number, and gender.
The attack vector: The breach occurred to a known configuration vulnerability in a third-party software that the University employs. While a patch was released by the third party some months prior, it had not been implemented and this let an attacker gain access to the data.
This data leak highlights the importance of patching and testing software in a timely manner. Complying with industry standard practices of software management is essential to ensure every point of access to data is secure, up-to-date, and protected against known gaps in third-party applications.