Front Rush frontrush.com Front Rush data breach: what happened and what to do
Front Rush, software used by college athletic programs for recruiting, said a storage bucket holding files was publicly accessible from January 18, 2016 to January 8, 2020. A security researcher reported it. Files included transcripts, injury reports and items athletes or parents uploaded.
View all 13,177 breaches- Breach date
- 18 Jan 2016
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Front Rush, LLC makes recruiting and team management software for college athletic programs. According to its notice, dated June 30, 2020, one of its cloud storage buckets was publicly accessible between January 18, 2016 and January 8, 2020. A security researcher alerted the company around January 5, 2020.
The company says the researcher told it he did not save or share any copies of the data. Press coverage noted that the logs were not enough to rule out other access.
Sources checked: bw.edu, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was in the bucket
The bucket held attachments that schools put into the platform, such as transcripts, injury reports and athletic reports. It also held files that student-athletes, prospective athletes or their parents uploaded in response to recruitment questionnaires. News reports described medical records, driver's licenses and test scores among the files. Those descriptions come from reporters, not from a count in the company's notice, and no figure for the number of people affected is given here.
What it means for you
The risk depends on what you uploaded. Medical details and ID documents are the kind of files criminals use for identity theft or targeted phishing that mentions a sport, school or coach. Notices went to people through the schools and programs that use Front Rush.
Where the notices were filed
The incident appears in state breach lists in California and Washington, which is why it is listed here.
What to do if you were in it
- 1
Read the notice you received
Schools and programs passed Front Rush's notice on. It says what the company holds on you and any protection it offers.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from seeing your credit report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Do this if you or a parent uploaded a Social Security number or a driver's license.
- 3
Check your accounts for the same details
If you uploaded medical or ID documents, watch your bank, insurance and credit reports for activity you don't recognize.
- 4
Treat messages that mention the breach as suspect
Scammers quote real breach details to look legitimate. Don't click links or call numbers in unexpected messages. Go to the company's website yourself, and see the FTC's phishing guide.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details turn up, so you know when to repeat these steps.
Frequently asked
Was I affected by the Front Rush breach?
If you used a college recruiting questionnaire or a school program that runs on Front Rush, possibly. The company's notice went out through schools and programs.
What was exposed?
Files placed in the platform, such as transcripts, injury reports and items athletes or parents uploaded. Reporters also described medical records and ID documents.
Did anyone actually take the data?
The company says the researcher who found it did not save or share copies. Press coverage noted the logs could not rule out other access.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
