Breach Disclosure: Chegg

In April 2018, college textbook rental company Chegg suffered a data breach. Exposed data included usernames, email and shipping addresses, and unsalted md5 hashed passwords. Unfortunately, md5 hashing is widely considered to be insecure and multiple vulnerabilities exist within the algorithm.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

Chegg, a California based textbook rental and study help website, was breached in April 2018. This breach contained usernames, email and shipping addresses, as well as unsalted passwords hashed via md5. Approximately 40 million accounts were compromised. Given the vulnerabilities and security issues within the md5 hashing algorithm, it is likely that these passwords could be unhashed and used to log into compromised Chegg accounts. Potentially, this could be used to make unauthorized purchases or to gain access to stored payment information.