ProctorU proctoru.com ProctorU data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In June 2020, online exam service ProctorU was breached and about 444,000 user records leaked: names, email and physical addresses, phone numbers, usernames and passwords stored as bcrypt hashes.
View all 13,118 breaches- Breach date
- 26 Jun 2020
- Affected
- 444,453
- Data exposed
- Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
ProctorU is an online exam proctoring service used by universities. Have I Been Pwned (HIBP) dates the breach to 26 June 2020 and added it on 6 August 2020. It describes about 444,000 user records that were shared widely in hacking communities.
ProctorU said it learned on 27 July 2020 that data claiming to come from its site had been posted on an internet message board. In statements reported by Hackread, the company said the data it had analysed was at least five years old and did not come from its active production servers.
Sources checked: haveibeenpwned.com, hackread.com
Last verified against the official page:
What was exposed
HIBP lists email addresses, names, passwords, phone numbers, physical addresses and usernames. The passwords were stored as bcrypt hashes, a strong method, so they are much harder to crack than weaker hashes. Easy passwords can still fall.
What it lets criminals do
Contact details are what scammers use. A message that knows your name, phone number and home address looks convincing, and students are common targets for fake fee and exam notices.
What to do
Change any password you shared with ProctorU, and be cautious with messages that mention exams or your school.
What to do if you were in it
- 1
Change your password, and any you reused
If you used your ProctorU password anywhere else, change it there too. A password manager makes unique passwords easy. Turn on two-factor login where you can.
- 2
Expect phishing that mentions the breach
Treat emails, texts and calls that quote your name, phone number or address as suspect. Don't click links in them; go to the company's site yourself.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the ProctorU breach?
Look up your email on Have I Been Pwned or run a free Serus scan. HIBP lists about 444,000 records.
What was exposed?
Names, email addresses, physical addresses, phone numbers, usernames and passwords stored as bcrypt hashes.
Should I change my password?
If you used ProctorU, yes, and change it anywhere you reused it. Turn on two-factor login.
Sources
- Have I Been Pwned: ProctorU
- Have I Been Pwned: ProctorU Data Breach · haveibeenpwned.com
- Online exam tool ProctorU admits breach after hackers leak its database · hackread.com
Something wrong or out of date? Tell us and we'll re-check it.
