Loading story…
VentureEd Solutions fixed a vulnerability in Ravenna Hub, a student admissions and application-tracking platform used across thousands of schools, after it was found to expose sensitive information about children and their families. The issue was an insecure direct object reference (IDOR) that allowed any authenticated user to access other users’ records by modifying sequential student identifiers in the URL, enabling access to data beyond their own account.
Exposed information included children’s names, dates of birth, home addresses, photos, and school details, along with parents’ email addresses and phone numbers and information about siblings. VentureEd’s CEO said the company was able to reproduce the issue and remediated it after being alerted, but the company did not clearly commit to user notification and did not confirm whether it can determine if improper access occurred; it also declined to provide details on third-party security testing or internal cybersecurity oversight.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
After TechCrunch discovered the flaw and alerted VentureEd Solutions, the company said it was able to reproduce the issue and fixed it the same day. VentureEd also said it was investigating the incident but did not commit to notifying affected users or say whether it could determine if any improper access had occurred.
An insecure direct object reference vulnerability in the Ravenna Hub student admissions platform allowed any logged-in user to access other families' student profiles by changing sequential profile or student ID values in the URL. Exposed information included children's names, dates of birth, addresses, photos, school details, sibling information, and parents' contact details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A significant data breach at Ravin Academy, a cybersecurity training center linked to Iran's Ministry of Intelligence and Security, resulted in the exposure of personal information belonging to over 1,000 individuals enrolled in its technical programs. The leaked records included usernames and phone numbers, and the incident was confirmed by the organization via its Telegram channel. Ravin Academy, established in 2019 and sanctioned by the U.S. Treasury in 2022 for supporting Iranian intelligence operations, offers courses in both defensive and offensive cyber skills, such as red-teaming, malware reverse engineering, and vulnerability analysis. The full dataset was provided to U.K.-based activist Nariman Gharib, who published portions of the information online. The academy characterized the breach as an attempt to damage its reputation and undermine national cybersecurity efforts in Iran. This incident occurred amid heightened Iranian cyber activity and increased tensions with Israel and the U.S., including a surge in ransomware attacks targeting healthcare and public health organizations. The breach highlights ongoing risks to organizations involved in nation-state cyber operations and the potential for sensitive data exposure to impact both individuals and broader security initiatives.
Jul 12, 2026
Hackers operating under the name 'Radiant' claimed responsibility for stealing sensitive data from Kido, a nursery chain with operations in the UK, US, China, and India. The attackers posted samples of the stolen data, including pictures and profiles of children, on their darknet website to prove their possession and issued a ransom demand to Kido, threatening to release more data if their demands were not met. The group escalated their threats by adding more children's profiles and publishing private data of dozens of Kido employees, such as names, addresses, National Insurance numbers, and contact details. In a further escalation, the criminals reportedly contacted parents directly with threatening phone calls, increasing the pressure on Kido to pay the ransom. Public backlash and condemnation from the cybersecurity community led the attackers to initially blur the children's images, though the data remained online. Eventually, the hackers removed all the data and issued an apology, claiming to have deleted all the children's data and expressing regret for their actions. Despite these claims, cybersecurity experts cautioned that data, once exposed online, is difficult to fully erase and may resurface in the future. The attackers also revealed that they had paid an initial access broker for entry into Kido’s systems, suggesting a broader criminal ecosystem at play. While the immediate threat to the children’s data appeared to subside, concerns remained about the long-term implications of the breach. In a separate but related incident, a security researcher discovered a data leak involving over 600 resumes and CVs of Kido employees or job applicants, primarily from the Amelio school in India and kidoschools.com. This leak was reported to Kido, who promptly secured the exposed data after being notified. The exposed resumes contained extensive personal information, raising additional privacy concerns for affected individuals. The data leak was found in a publicly accessible storage bucket, which had been listed on Grayhatwarfare, indicating the possibility that others may have accessed the information before it was secured. Kido’s spokesperson confirmed the data had been locked down, but the company was still investigating the extent of unauthorized access. The dual incidents highlight significant weaknesses in Kido’s data security practices and underscore the risks faced by organizations handling sensitive information about children and employees. The breaches prompted discussions about the adequacy of Kido’s incident response and the need for improved security controls. The events also serve as a warning to other educational institutions about the importance of safeguarding personal data and monitoring for potential exposures. The public and regulatory scrutiny following these incidents is likely to drive further changes in Kido’s security posture and notification practices. The situation remains fluid as Kido continues to assess the full impact and potential obligations to notify affected individuals.
Jun 29, 2026
Security researchers identified critical vulnerabilities in educational institution web applications, enabling unauthorized access to sensitive student data. In one case, a penetration tester discovered a SQL injection flaw in an educational website's receipt download endpoint, which allowed the attacker to enumerate university numbers, exploit the vulnerability using `sqlmap`, and ultimately dump the database containing personally identifiable information (PII) of students. Attempts to escalate the attack to an OS shell were unsuccessful due to insufficient permissions, but the exposure of student records highlights the severity of the flaw. Another incident involved a manual penetration test against a major university's web infrastructure, where the tester bypassed automated tools and used manual techniques to identify and exploit weaknesses in a subdomain's registration functionality. The attacker was able to register as a non-member, receive verification codes, and gain deeper access, demonstrating the risks posed by insufficient input validation and weak authentication mechanisms in academic environments. These incidents underscore the ongoing threat of SQL injection and the need for robust security controls in educational sector web applications.
Jul 12, 2026