DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

Vulnerability: Est. Millions of Users of Popular Educational Platform Exposed to Account Takeover Threats And More

Posted on April 6, 2021 by Dissent

A lot of universities have been attacked recently.  Not all attacks are  related to the Moodle vulnerability described in this report (e.g., all the Accellion-related university breaches), but the Moodle vulnerability worth noting and addressing if it applies to your uni. Chase Williams reports:

At the beginning of October 2020, the Wizcase cyber research team, led by Ata Hakcil, discovered a security vulnerability in the open-source learning platform Moodle. Anyone who had an account on a given school’s Moodle (with TeX filter enabled) could then take over students’ accounts, professors, and even the accounts managed by the platform administrators.

Moodle is an open-source educational platform used by 179,000 sites and has 242 million users. It allows universities to distribute content to students and teachers. It allows teachers to easily communicate with students, organize and post links, documents, assignments, quizzes, and grades.

Read more on Wizcase.

 


Related:

  • Report released on PowerSchool cyber attack
  • Sue The Hackers – Google Sues Over Phishing as a Service
  • Princeton University Data Breach Impacts Alumni, Students, Employees
  • From bad to worse: Doctor Alliance hacked again by same threat actor (2)
  • Checkout.com Discloses Data Breach After Extortion Attempt
  • Did you hear the one about the ransom victim who made a ransom installment payment after they were told that it wouldn't be accepted?
Category: Commentaries and AnalysesEducation Sector

Post navigation

← Technological University of Dublin victim of ransomware attack
Chinese Hackers Selling Intimate Stolen Camera Footage →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • Google and Apple roll out emergency security updates after zero-day attacks
  • Doxers Posing as Cops Are Tricking Big Tech Firms Into Sharing People’s Private Data
  • Virginia Urology Silent on Possible Data Breach as Purported Patient Data Begins to Leak
  • Village of Golf Manor considering paying ransom amid cyberattack (1)
  • Teen who allegedly stole millions of personal data records arrested in Spain
  • Akira ransomware: FBI tallies 250 million in payouts
  • IE: HSE confirms second ransomware attack but ‘no evidence’ patient data was stolen
  • Examining impact of federal relief program after major healthcare cyberattack — Research Brief
  • Justice Department Announces Actions to Combat Two Russian State-Sponsored Hacking Groups
  • Should entities be required to disclose the name of a vendor if the breach was at the vendor’s?

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Slovenian officials weaponize data-privacy laws against investigative journalism
  • End-of-Year 2025 State and Federal Developments in Minors’ Privacy
  • Tool allows stealthy tracking of Signal and WhatsApp users through delivery receipts
  • Oh Great, Smart Glasses That Record Everything You Say
  • CBP Agents Held This U.S. Citizen for Hours Until He Agreed To Let Them Search His Electronic Devices

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net
Security Issue: security[at]databreaches.net
Mastodon: Infosec.Exchange/@PogoWasRight
Signal: Dissent.73
DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.