Breach Disclosure: DataCamp

In late March 2019, DataCamp, a data science e-learning platform, disclosed a data breach via a post on their website. The breach occurred on February 11, 2019 by a third-party who gained “criminal unauthorized access” to the DataCamp platform. The company claims a subset of its user base was affected and they immediately engaged with a third party forensic firm to help investigate. The data exposed includes 760,000 records of emails, IP addresses, bcrypt hashed passwords and names.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The company says no payment data was accessed since they do not store payment data. The company used bcrypt to hash their passwords, which is a cryptographic hash function designed specifically for hashing passwords, reducing the risk of brute forcing passwords at scale. The company logged out all affected users and issued password resets where appropriate. The full list of exposed data includes name, email addresses, optional personal data, hashed passwords, created dates, last sign in dates and sign in IP addresses.