Breach Disclosure: TaiLieu

Vietnamese educational website, TaiLieu[.]vn, experienced a data breach resulting in the exposure of user data. It is currently unknown as to who is responsible for the breach. Nearly 7 million user records, including usernames and unsalted MD5 hashed passwords, have been exposed. This breach is available for sale on a popular hacker forum for a minimal price.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

In November 2019, TaiLieu was breached and the leaked data was recently posted on a popular hacker forum. The incident resulted in the exposure of more than 7,000,000 records that contained the Personally Identifiable Information (PII) of TaiLieu[.]vn users, which is now available for sale on the dark web for an insignificant price of approximately 8 credits. This poster also included a screenshot of the breached data, which appears to be legitimate.

Figure 1: Screenshot of the leak advertised on a popular hacker forum.

The breached information included the following details:

User names
Email addresses
Dates of birth
Gender information
Passwords

The exposed passwords were stored as unsalted MD5 hashes. The MD5 hash algorithm is relatively trivial to reverse, and it is likely plain text passwords will be revealed.