2020 WhiteHat Jr — 280,000 records
Data compromised
Student/parent/teacher PII, photos, class videos, salary docs
Technical writeup
Nov 2020. WhiteHat Jr (Byju's subsidiary) left AWS servers open; exposed student names, ages, gender, photos, progress reports, parent/teacher contacts, salary docs, class videos. API vulns allowed viewing others' transaction data. Researcher reported Nov 19; patched within 24h. Company denied 'breach' but acknowledged vulnerabilities.
Root cause
Misconfigured AWS servers; API authorization flaws.