OneClass

Summary

Researchers at vpnMentor discovered an unsecured Elasticsearch database belonging to OneClass exposing 27 GB of user data. OneClass is an online learning platform used by colleges nationwide in which instructors can post study guides, and provide learning materials and tutoring to students as young as age thirteen. Exposed data includes full names, email addresses, phone numbers, schools and universities attended, course enrollment, and account details totaling approximately 8.9 million records affecting over one million users. The database was secured within 24 hours of disclosure; though at the time of this writing, it is unknown who else may have accessed the exposed information. Much of the breached data could be used by cyber-criminals in targeted phishing campaigns against account holders, including minors.