- Hacker tells media they broke into publishing giant Scholastic
- They then stole sensitive information about millions of people
- The data will not be made public and was stolen “for fun”, says hacker
Publishing and media giant Scholastic has reportedly suffered a cyber attack in which it lost sensitive information about millions of people.
A hacker who goes by the alias “Parasocial” claims to have stolen data through an employee portal, including people’s names, email addresses, phone numbers and postal addresses, for US clients and “training contacts”. This latter group makes up about one million, out of a total of eight million entries.
In its report, Daily dot says the database contains more than four million unique email addresses. In addition, Parasocial provided its researchers with a sample from which they could infer that the data is legitimate. They didn’t reach out to the people directly, but came to some conclusions after reading their LinkedIn information and other social media accounts.
Authentic sample
Scholastic is known for its books, educational materials and popular series such as Harry Potter, The Hunger Games and Goosebumps. Parents, teachers and administrators can sign up for an account on the platform. Parents must enter complete data about their children and teachers must indicate the school they work for.
The attacker said that their motives were simple entertainment and that they will not publish the files on the Internet.
“To Scholastic; lol get pwned. This is a lesson that has to be learned the hard way. Don’t let your customers get hit by your security flaws, use MFA,” Daily dot quoted Parasocial as saying, adding that they would have taken even more information but were stopped by the server’s export limits.
In a statement to Daily dotA representative for Scholastic said the company was investigating the claim.
“Scholastic takes the security of our customers’ data seriously with extensive systems and protocols in place and is thoroughly investigating this allegation,” they said.
