Security News > 2024 > August > Attacker steals personal data of 200k+ people with links to Arizona tech school

An Arizona tech school will send letters to 208,717 current and former students, staff, and parents whose data was exposed during a January break-in that allowed an attacker to steal nearly 50 types of personal info.

EVIT itself also said it "Has not discovered any publication of EVIT data that contained sensitive information," although third party contractors determined that a trove of data was stolen.

In total, 48 different classes of data were potentially stolen.

"Most likely in other cases attackers only got access to partial data and in this case, it looks like they may have got access to all of the data. It could also be the system where the data was exposed. It could be the fact they got access to the database, versus an API. Or if they did get access to an API, that API was returning all of the information - I've seen this happen before."

"This also shows the importance of minimizing the amount of data that organizations collect and store. Organizations should only collect data that they absolutely require for their business needs."

"EVIT engaged a third party specializing in network security to help EVIT with adding these and other computer security protections and protocols to harden its network infrastructure and offer improved protections of sensitive data from unauthorized access."

News URL

https://go.theregister.com/feed/www.theregister.com/2024/08/12/200k_with_links_to_arizona/