\n<\/p>\n
Byju\u2019s, the edtech giant and India\u2019s most valuable startup<\/a>, has fixed a server-side misconfiguration that was exposing sensitive data of its students.<\/p>\n The Indian startup exposed some students\u2019 names, phone numbers, addresses and email IDs. The exposed data also included loan details such as payouts, links to scanned documents and transactional information related to some students.<\/p>\n Security researcher Bob Diachenko<\/a> found the exposure due to a misconfigured Apache Kafka server used by Byju\u2019s to send and receive data in real time. Diachenko told TechCrunch that there were several IP addresses with the misconfigured server, which enabled anyone to access the queue to read the records without a password.<\/p>\n \u201cAnyone could have connected to the queue and read or download the messages,\u201d the researcher told TechCrunch.<\/p>\n The data was first found to be exposed on August 15, according to Shodan, a search engine for exposed devices and databases.<\/p>\n While the exact number of students whose data was exposed is unclear, Diachenko said one to two million records were accessible due to the issue.<\/p>\n Diachenko reported the issue to Byju\u2019s directly on August 22. The misconfiguration was fixed soon after the researcher posted<\/a> its details on X, the platform formerly known as Twitter, a day later.<\/p>\n Byju\u2019s confirmed to TechCrunch it had fixed the security lapse but claimed \u201cno data or information was exposed or compromised\u201d during the week that the servers were exposed.<\/p>\n \u201cThere was a temporary exposure of a small fraction of our systems for a very short duration,\u201d said Anil Goel, Byju\u2019s chief technology officer, in a prepared statement. \u201cOur technical team has promptly resolved this issue as soon as it came to our notice. We would like to reiterate that all our systems have been built around safeguarding the privacy and security of our data.\u201d<\/p>\n Byju\u2019s did not confirm the exact number of students affected and did not respond to a question regarding whether the company had notified students of the lapse. Byju\u2019s also would not say if it had the technical means to determine what data, if any, was accessed, and by whom.<\/p>\n TechCrunch informed India\u2019s computer emergency response team CERT-In about the incident after receiving details from the researcher.<\/p>\n In June 2021, a server-side issue affecting Byju\u2019s third-party service provider Salesken.ai exposed<\/a> student data, including the personal details about what classes students were taking through the startup\u2019s online coding platform WhiteHatJr. Salesken.ai pulled the server offline shortly after TechCrunch reached out to the startup.<\/p>\n Unlike the previous exposure due to the misconfiguration in a Salesken.ai server, the latest issue specifically affects Byju\u2019s infrastructure.<\/p>\n The data exposure added to the woes of Byju\u2019s, a Bengaluru-based startup valued at $22 billion, which is currently grappling with multiple challenges.<\/p>\n The startup\u2019s three key investors \u2014 Peak XV Partners (erstwhile Sequoia Capital India & SEA), Prosus and Chan Zuckerberg Initiative \u2014 quit its board<\/a> in June, a year after it attracted global scrutiny over delaying financial reporting. Prosus, one of the largest investors in Byju\u2019s, said<\/a> on its exit from board that its reporting and governance structures \u201cdid not evolve sufficiently for a company of that scale.\u201d The investment firm also slashed the valuation of the edtech startup to $5.1 billion<\/a> in June from the $6 billion it had valued until November.<\/p>\n Earlier this year, Deloitte also made an early exit<\/a> from Byju\u2019s as its auditor for long delaying its financial statements.<\/p>\n Additionally, the startup has continued to lay off employees<\/a>, including up to 1,000 people<\/a> in June, to reduce costs.<\/p>\n Moreover, Byju\u2019s saw searches from the Indian anti-money laundering agency<\/a> at its offices, and reportedly a probe by the country\u2019s corporate affairs ministry<\/a> and tensions with its lenders<\/a> on a $1.2 billion term loan \u2014 all at the time it was looking to raise more capital after a $250 million round<\/a> in May.<\/p>\n<\/p><\/div>\n