Over 3M individuals exposed by unsecured PrepHero database

Hackread reports that U.S. college sports scholarship and recruitment assistance platform PrepHero had more than 3.1 million records belonging to high school athletes and their coaches inadvertently exposed by a misconfigured database.

Included in the unprotected database were student-athletes' names, phone numbers, home addresses, email addresses, and passport details, as well as their parents' and coaches' contact information, and other files containing links to students' passport images, according to an investigation by cybersecurity researcher Jeremy Fowler published on vpnMentor. Fowler also noted the exposure of a "mail cache" folder with 10 GB of email messages since 2017, some of which had temporary credentials and audio recordings of coaches mentioning personal information and student athlete assessments. PrepHero has already moved to secure the database upon the reporting of Fowler, who warned against the use of web links to sites with PII. Such a development comes just days after the popular student engagement platform iClicker was reported to have been compromised in a ClickFix attack.