Thousands of children attending schools and daycare centers across Quebec had their data exposed as a result of vulnerabilities in the widely used student pickup time-coordinating app HopHop, which was not approved by the Quebec Ministry of Education, reports Cybernews.
Multiple flaws within the app, which were already addressed, inadvertently leaked from Sept. 29 and Oct. 7 children's full names and photos, parents' and guardians' full names, app users' photos, and names of attended schools. Malicious actors could also potentially leverage the HopHop app's button to fraudulently notify the school of an imminent parent pickup, according to security expert Patrick Mathieu, who discovered the issues while tinkering with the app used by the school attended by his children.
Such security concerns have prompted the Quebec government to prohibit HopHop app usage across all schools and daycares. "It remains the responsibility of the school service center to ensure that when an application is favored by a daycare, CSS, for example, that it passes the necessary test provided for by law," said Quebec Education Minister Sonia LeBel.
Multiple flaws within the app, which were already addressed, inadvertently leaked from Sept. 29 and Oct. 7 children's full names and photos, parents' and guardians' full names, app users' photos, and names of attended schools. Malicious actors could also potentially leverage the HopHop app's button to fraudulently notify the school of an imminent parent pickup, according to security expert Patrick Mathieu, who discovered the issues while tinkering with the app used by the school attended by his children.
Such security concerns have prompted the Quebec government to prohibit HopHop app usage across all schools and daycares. "It remains the responsibility of the school service center to ensure that when an application is favored by a daycare, CSS, for example, that it passes the necessary test provided for by law," said Quebec Education Minister Sonia LeBel.
