Unsecured SAIS database exposed 682,000 school records

Security researcher Jeremiah Fowler reported in late July 2023 that he had found a database belonging to the Southern Association of Independent Schools sitting online with no password protection. SAIS is an accreditation and support body for more than 380 independent K-12 schools across the United States, the Caribbean and Latin America, serving upwards of 220,000 students.

Fowler put the contents at 682,438 records totaling roughly 572 gigabytes, held in PDF, Excel, PowerPoint, Word and image formats, with documents dated between 2012 and 2023.

The material was unusually sensitive for an education dataset. It included student and teacher records, student medical and immunization information, teacher background checks and Social Security numbers, parent contact details, school budgets and loan agreements. It also held physical security material: active shooter and lockdown notifications, campus maps, and third party security assessments describing camera positions and building entry points.

Fowler sent a responsible disclosure notice and SAIS secured the database from public access shortly afterwards. There was no indication in the published reporting that anyone other than the researcher had accessed the data, and SAIS did not comment publicly on the finding at the time.