UStrive security lapse exposed personal data of its users, including children

TechCrunch reported that UStrive (formerly Strive for College) had a security lapse where a misconfigured GraphQL endpoint exposed personal information—full names, emails, phone numbers, gender, date of birth and other user-provided data—of at least 238,000 accounts (including children) to any logged-in user; UStrive says the issue was remediated but has not confirmed user notification or whether data was accessed maliciously.