Code.org, a non-profit organization that helps students learn computer science, informed users over the weekend that a flaw on its website allowed unauthorized parties to access the email addresses of its volunteers.
The organization learned of the vulnerability on Friday night after at least ten of its volunteers received unwanted job offers from a Singapore-based recruiting firm that had leveraged the “error” to obtain private email addresses.
After being contacted by Code.org for an explanation, the recruiting company appologized and promised to delete the collected email addresses and stop sending messages to the addresses it obtained by exploiting the bug.
“Based on [the recruiting firm’s] response, it’s possible the vulnerability may have had limited impact, but we can’t be sure,” Hadi Partovi, CEO of Code.org, wrote in a blog post. “Regardless, we’ve also inspected and secured the rest of our site from similar vulnerabilities.”
The vulnerability was quickly patched and Partovi pointed out that this was not a data breach, rather a mistake on their part that left volunteer email addresses “accessible via the web browser.”
The Code.org CEO said none of its servers were vulnerable, and the details of its 10 million teachers and students were not exposed at any time. Partovi also noted that the organization does not store the email addresses of students aged under 13.
In an email sent to affected individuals, Code.org said the incident was caused by a client-side vulnerability in its volunteer map. The email also revealed that location data was also exposed if it was provided to Code.org.
Related: Verizon Fixes Vulnerability Exposing User Email Accounts
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- New York Man Arrested for Running BreachForums Cybercrime Website
- Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies
- Mozilla Patches High-Severity Vulnerabilities With Release of Firefox 111
- Microsoft: 17 European Nations Targeted by Russia in 2023 as Espionage Ramping Up
- Cybercriminals, APT Exploited Telerik Vulnerability in Attacks on US Government Agency
- US Charges Two Men Over Use of Hacked Law Enforcement Database for Doxing
Latest News
- Ferrari Says Ransomware Attack Exposed Customer Data
- Aembit Scores $16.6M Seed Funding for Workload IAM Technology
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- New York Man Arrested for Running BreachForums Cybercrime Website
