Chegg chegg.com Chegg data breach 2018: what happened and what to do
In April 2018 attackers got into a Chegg database. HIBP counts about 40 million subscribers, with email addresses, usernames, names and unsalted MD5 password hashes exposed. Chegg learned of it in September 2018 and reset passwords.
View all 13,115 breaches- Breach date
- 28 Apr 2018
- Affected
- 39,721,127
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Chegg, the textbook rental and homework help service, was breached in April 2018. TechCrunch reported that Chegg only learned of it on September 19, 2018, and filed a notice with the SEC on September 25. A database holding user data for Chegg and affiliated brands such as EasyBib was accessed.
What was exposed
Have I Been Pwned (HIBP) counts 39,721,127 subscribers. The data included email addresses and usernames, names, and passwords stored as unsalted MD5 hashes. A small number of records also had a physical address or phone number. Chegg said it didn't believe financial data or Social Security numbers were taken.
Why unsalted MD5 matters
A hash is a scrambled version of a password. MD5 is old and fast. Without a salt and without a salt (a random value added before hashing) identical passwords produce identical hashes. Attackers can crack common passwords from a list in bulk. If your Chegg password was weak or reused, assume it can be read.
That's where the real risk sits: credential stuffing, where criminals try the same email and password pair on other sites.
The company's response
Chegg reset the passwords of about 40 million users and told people to change passwords on other services if they'd reused them. This page covers only the 2018 breach.
What to do if you were in it
- 1
Change your password and any copy of it
Change your Chegg password, then change it on every other account where you used the same or a similar one. Do this even if Chegg already forced a reset, because the old password may still work somewhere else. Turn on two-factor login where it's offered, and use a password manager so each account gets its own password.
- 2
Check the accounts that shared that password
Start with your email, then banking and shopping. Email comes first because it resets everything else.
- 3
Expect phishing that uses real details
With your email address and name in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Chegg breach?
HIBP lists 39,721,127 subscribers from the April 2018 breach. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Chegg breach?
Email addresses, usernames, names and unsalted MD5 password hashes. A small number of records also had a physical address or phone number.
Should I change my password after the Chegg breach?
Yes. Change it on Chegg and on every site where you used the same password, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
