UStrive Mentorship Platform Security Breach Exposes Sensitive User Data, Including Children
Published
Key Takeaways
- Vulnerability Identified: A misconfigured GraphQL endpoint on the UStrive mentorship platform allowed authenticated users to access the private data of other users.
- Scope of Exposure: This potentially affected at least 238,000 records, including names, email addresses, phone numbers, and demographic data.
- Remediation Status: UStrive has patched the vulnerability following disclosure, though it has not confirmed whether it will notify affected individuals.
UStrive, a nonprofit online mentorship platform that connects high school and college students with mentors, suffered a security lapse stemming from an improperly secured Amazon-hosted GraphQL endpoint. This architectural flaw permitted any logged-in user to query the backend database and retrieve non-public information belonging to other users.Â
Technical Analysis of the User Data Vulnerability
The flaw was discovered through network traffic analysis. By inspecting browser traffic, an unauthorized logged-in user could execute queries to harvest structured data streams from the organization's servers.Â
At the time of data breach discovery, the accessible database contained approximately 238,000 user records, according to TechCrunch. The exposed dataset included personally identifiable information (PII) such as:
- Full names,Â
- Contact details,Â
- Gender and date of birth in some instances.
Company Response and Remediation
Following the responsible disclosure of the vulnerability, UStrive’s Chief Technology Officer, Dwamian Mcleish, stated late Thursday that the issue has been "remediated." However, the organization's legal representation indicated limitations in their response due to ongoing litigation with a former software engineer.Â
Despite the fix, UStrive has not committed to notifying the affected user base, nor has it clarified if forensic analysis was conducted to detect potential malicious exploitation prior to the patch. This lack of transparency regarding breach notification protocols highlights a critical gap in incident response management.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular