Exploit: Unsecured Database
United States Department of Education: Federal Government Agency
Risk to Small Business: 2.077 = Severe
A large number of Americans may have had their personally identifiable data compromised by the United States Department of Education. According to reports, the agency left the Social Security numbers of tens of thousands of people seeking student debt relief unprotected and susceptible to a data breach for at least six months. While the information was stored securely enough to prevent an external breach, any users of the agency’s systems could freely access the information in a simple shared folder, including outside contractors.
Individual Risk: 2.316 = Severe
The breached information was collected from complaints filing for student debt relief after paying for years of education of dubious value from for-profit colleges. Personally identifiable information, including Social Security numbers, was not secured correctly. The information was easily obtained by anyone with access to agency or contractor systems. Those who suspect that they may be at risk should watch their credit reports and be on alert for spear phishing attacks.
Customers Impacted: 240,000
How it Could Affect Your Customers’ Business: Failure to secure a customer’s information briefly is bad enough but allowing that information to stay unsecured for more than 6 months shows indicates an overall lack of concern regarding cybersecurity that may make future clients think twice about starting a business relationship.