Update on Chegg Data Breach: Decrypted credentials now leading to multiple campus security attacks

On September 19, 2018, Chegg learned that on or around April 29, 2018, an unauthorized party gained access to a Company database that hosts user data for chegg.com and certain of the Company’s family of brands such as EasyBib. The Company understands that the information that may have been obtained could include a Chegg user’s name, email address, shipping address, Chegg username, and hashed Chegg password. The investigation into the incident, which is supported by third-party forensics, is ongoing. To date, the Company understands that no social security numbers or financial information such as users’ credit card numbers or bank account information were obtained.

What is problematic with the Chegg data breach is that no further information has been made public and there has yet to be any interest from the broader ed tech press to dig up answers. We have no idea how serious this breach is, and I do not believe that the users with compromised personal information have had any updates since the initial email blast and associated post.

In 2018, Chegg.com, a company that offers textbook rental and tutoring services suffered a data breach resulting in the loss of 40 million customer records which included full names, email addresses, usernames, and passwords. Now the results of Chegg’s 2018 data breach have been publicly exposed online, which poses a substantial threat. If users happen to reuse or slightly modify passwords across multiple services, publicly exposed credentials can be exploited.

Several universities across the nation have reported malicious use of these leaked email addresses and passwords which were contained in the Chegg breach. This is of concern for anyone who may have signed up for Chegg using their Tulane email address and a password similar or identical to their Tulane.edu password. Several Tulane students and alumni have reached out to the IT service desk affected by this breach of Chegg data.

Junior Sophie Koeppl, a Chegg user since her freshman year of college, said she was alerted to the breach by the College and was not contacted directly by the textbook provider.

“I never got an email from Chegg confirming the security breach that happened last year,” Koeppl said.

Kathy Hausmann, associate director for technical support services at Saint Mary’s, said the information obtained in the 2018 breach potentially included a Chegg user’s name, email address, shipping address, Chegg username and hashed Chegg password.

“Saint Mary’s College received a notification from REN-ISAC (Research and Education Networks Information Sharing and Analysis Center) ‘that some credentials from your institution have appeared in a credential dump related to the Chegg data breach,’” Hausmann said in an email. “The information obtained from the Chegg data breach had been shared online for others to do further damage beyond the initial data breach of Chegg.”

According to a news alert sent by UCF INFOSEC Wednesday morning, the weak encryption used to store user data was the primary cause of cyber criminals gaining access to the information of thousands of users.

Let’s start with the news. So it was — so no, we were not cognizant ahead of the announcing of the [Thinkful] data breach.

We obviously were made aware, the moment that they knew. And fortunately, similar to ours, which, as you know, amounted to nothing. There was no pertinently identifiable information, no credit card information. And they don’t have — their customer base is much smaller than ours, obviously, and they charge a lot more.

So it was a non-variable as best as we can tell. And everything that we looked at afterwards, we’ve asked them to follow the exact same protocols that we did, which was complete and open transparency, communicate immediately, notify everybody. Openly notify people because, unfortunately, it’s a fact of life in technology that these things are going to happen. But fortunately, neither one of us has the PI or the credit card information.

“After hashed passwords are decrypted, the passwords can be used to sign into affected accounts if the passwords were not already changed,” Hausmann said. “There is also the concern that the released e-mail addresses and passwords could be used to try and gain access into accounts unrelated to Chegg, including e-mail, social media and finance-related websites.”