Breach Disclosure: Vedantu

Sometime in July, the Bengaluru-based online tutorial platform Vedantu experienced a data breach impacting 687,000 records of users on the site. This breach impacted around 10% of its overall user base, and contained user ID's, names, emails, phone numbers, passwords, and other location based information.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

Around July of this year, Vedantu, which provides online tutoring services experienced a data breach. According to a poster in a popular data breach site, this breach occurred due to an exposed MongoDB instance. While the response from Vedantu stated that the breach did not include user passwords, the sample files posted on the forum included the users password.

There were two files contained in the dump, one for user registration information and the other for user profile information, with the profile information including a large amount of data regarding the user. In the user profile information, there is a plaintext value for the users password, along with hashed passwords of the most recent passwords.