Edulog’s Parent Portal May Not Be Safe

The Edulog’s Parent Portal is used by many school districts nationwide, with around 7,500 K-12 school districts using the portals. Parents use this portal to keep track of their child's bus, to be sure they get to their destination. In mid-December 2023, Tenable Research uncovered security vulnerabilities in Edulog’s Parent Portal that could make it possible for hackers to track your child.

When the researchers used the security flaw, they were able to access personal information like:

• Student names
• Assigned bus routes
• Parent contact information
• GPS data
• Usernames
• Encrypted passwords for third-party integrations

While the security flaw now seems to be fixed, parents were never alerted that the information could be vulnerable or if any information was linked. Even worse, even though the initial problem was fixed, it's still very easy for bad actors to gain access to the Edulog system.

"For example, even without the vulnerabilities discovered in the Parent Portal services, there isn’t necessarily anything stopping a malicious actor from signing up for an account and obtaining a registration code for a given school through other means. The actor could ask another parent, call
the school and pretend to be a parent, or simply search for one on the internet," Jimi Sebree, senior staff research engineer at Tenable, said in a post on the company's site.

What can parents do? First, be sure to change the passwords to any third-party apps you have connected to Edulog. You may also want to contact Edulog to see if they know of any data leaks due to the vulnerability. We also recommend getting familiar with the signs of child identity theft and how to combat it. 

• Identity Theft Prevention for Parents: Understanding Identity Theft and Its Impact on Children
• Recognizing the Signs of Child Identity Theft
• How to Combat Child Identity Theft
• Getting Your Child to School Safely
• 6 Ways You Can Help Your Kids Stay Safe at School