Breaching big companies in hopes of harvesting sensitive information has become a very common practice among cybercriminals in the past couple of years. The year 2023 have seen a fair share of those, be it outsourcing services provider like Capita or evenUnited Healthcare. Now, Brightly is taking the spotlight.
Brightly Software, a U.S. tech company and Siemens subsidiary has disclosed a data breach in which cybercriminals were able to harvest its customers’ sensitive information and credentials.
The attack targeted the company’s SchoolDudeonlineplatform, and the individuals behind it managed to get a hold of its database, exposing a lot of private information. What is this breach about? More on that later in the article.
Another Breach? Not So Bright for Brightly
As we always say, threat actors prefer targeting big companies that can provide a lot of beneficial information. Whether they use it for ransomware, sell it to other criminals, or for any other reason; they will benefit in the end.
What big companies? Well, if it’s Hyundai, for example, it is a huge company, and Brightly is no different. The main target in the attack was Brightly’s SchoolDude cloud-based platform.
This service caters to over 7,000 colleges, universities, and schools hosting over 600,000. With these numbers, we would definitely assume the impact this breach can do.
What makes this breach even bigger is the fact that it’s not limited to a single country. In fact, Brightly SaaS solutions are used in several regions, including the United States, Canada, the United Kingdom, and Australia.
The company notified its customers with a letter, informing them that a breach had exposed their personal information and credentials:
“We at Brightly Software are writing to let you know about a recent security incident affecting an account you have on our SchoolDude application (schooldude.com), an online platform used by educational institutions for placing and tracking maintenance work orders.
“The incident involved an unauthorized actor obtaining certain account information from the SchoolDude user database.”
According to the breach letter, the threat actors managed to get their hands on various types of data. This includes:
Customer names
Email addresses
Account passwords
Phone numbers
School district names
As an immediate precaution, Brightly went on to reset SchoolDude users’ passwords. The company recommends choosing new ones by selecting the “Forgot Login Name or Password?” option on login.schooldude.com.
Users should not take this lightly and create strong passwords that are hard to guess. Also, never use the same password on multiple accounts; you’ll be doing the threat actors a huge favor.
Beware of Future Attacks
When personal information is what the threat actors have harvested, they can do so much more than threaten the company itself.
Since email addresses and telephone numbers are in the mix, phishing and smishing attacks must be on the table.
Cybercriminals might take advantage of the data they collect. They can perform malicious attacks, so we highly recommend complete caution when handling emails and SMS.
Apart from covering the latest news and trends related to online privacy and cybersecurity, Tom has also worked at IT departments of several companies in the United States.
