Misconfigurations and Exposed Credentials Drive Repeated University Breaches
Summary
Huntress identifies decentralized IT, misconfigurations, and exposed credentials as recurring causes of 2026 higher-education breaches, and recommends greater visibility into connected systems and identity access.
Key points
- Newcastle University reported that an admissions-system configuration issue exposed contact information for about 440,000 people.
- The University of Western Australia found student-system access credentials exposed online; Avans University found personal data exposed through a Power BI misconfiguration.
- The article also cites the ShinyHunters breach of Instructure’s Canvas platform and exploitation of an unpatched Oracle PeopleSoft flaw across more than 300 instances.
- The article attributes recurring exposure to universities’ decentralized IT environments, inconsistent standards, and limited staffing.
- It recommends inventorying integrations and exposed systems, monitoring identity as closely as endpoints, and maintaining visibility across decentralized environments.
Article Details
- Topic
- Recurring data breaches and exposure incidents in higher education caused by misconfigurations and exposed credentials in decentralized IT environments.
People
Caitlin SarianDiscussed education technology vendors’ security responsibilities and school cybersecurity with Jen Easterly at Black Hat; also known as Cybersecurity Girl.Jen EasterlyDiscussed education technology vendors’ security responsibilities and school cybersecurity with Caitlin Sarian at Black Hat.
Threat Actors
Vendors
Products
Callistathe University of Western Australia found that an administrator had left system access credentials for Callista, its student information system, exposed online. Just a credential that shouldn't have been reachable,CanvasAnd earlier this year, Instructure's Canvas platform, used by roughly 9,000 schools, was breached by the extortion group ShinyHunters. The group claimed 275 million records and later defaced Canvas login portals atOracle PeopleSoftweek. 90 days after that, the same group exploited an unpatched remote-code-execution flaw in Oracle PeopleSoft, reaching more than 300 instances at over 100 organizations, most of them universities.Power BIAround the same time, Avans University of Applied Sciences in the Netherlands discovered a Power BI misconfiguration had quietly exposed personal data to unauthorized viewers for nearly a year before anyone noticed.