Varsity Tutors varsitytutors.com

Varsity Tutors data breach: what happened and what to do

Varsity Tutors told regulators that a misconfigured cloud storage bucket may have exposed government-issued photo IDs of 24,421 people between November 1 and 6, 2021. It sent notices on June 3, 2022 and offered 12 months of identity protection.

View all 13,177 breaches
Breach date
Nov 2021
Made public
3 Jun 2022
Affected
24,421
Data exposed
Government issued IDs
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Varsity Tutors, the online tutoring company, filed breach notices with state attorneys general in June 2022. The company said an independent cyber researcher told it in late October 2021 that an Amazon Web Services storage bucket (a cloud folder) might be set up so that anyone could open it. Varsity Tutors fixed the setting. The filing gives the exposure window as November 1 to November 6, 2021, and says the company discovered the problem on May 11, 2022.

The company could not rule out that someone had accessed or copied files from the bucket. It sent written notices on June 3, 2022 to 24,421 people in total, according to the Maine Attorney General's filing. California's breach list shows the same dates.

Sources checked: maine.gov, oag.ca.gov, consumer.ftc.gov

Last verified against the official page:

How we research this Report an error

What was exposed

The filing names one type of data: government-issued photo identification, such as a driver's license or passport image. It does not list passwords or payment cards.

An ID photo is more sensitive than an email address. It shows your full name, date of birth and often your home address in one image, which is what a criminal needs to pass a weak identity check or to build a convincing fake profile. It can also make a phishing message that quotes your details look real.

The company's response

Varsity Tutors fixed the bucket setting and offered 12 months of identity protection to the people it notified. If you got a letter, the offer and the sign-up steps are in it.

Was your data in it?

The company wrote to the people it identified. If you never used Varsity Tutors, or you got no letter, there is no sign your data was involved.

What to do if you were in it

  1. 1

    Read your notice and take the identity protection offer

    If you got a letter from Varsity Tutors, it explains how to sign up for the 12 months of identity protection. The FTC recommends taking free credit monitoring when a company offers it.

  2. 2

    Freeze your credit

    A leaked ID photo can be used to open accounts in your name. A credit freeze is free and stops new credit being opened. Follow the FTC's steps to freeze your file at Equifax, Experian and TransUnion.

  3. 3

    Watch your statements and credit reports

    Check your accounts for charges or accounts you don't recognize. If something looks wrong, report it and build a recovery plan at IdentityTheft.gov.

  4. 4

    Be careful with messages that mention the breach

    Scammers sometimes pose as the company and ask you to confirm your ID. Don't click links in unexpected messages. Go to the company's site yourself.

  5. 5

    Check whether your email or phone is in this and other breaches

    Run a free Serus scan to see which breaches include your email address or phone number, and what else is exposed about you online.

Official filings

Timeline

  1. The breach happened

  2. The company made it public

  3. Reported to the Washington Attorney General

Frequently asked

Was I affected by the Varsity Tutors breach?

The company mailed notices to the people it identified, 24,421 in total. If you got a letter, your information was in the exposed bucket or could not be ruled out. If you got none, you were not on the list.

What was exposed?

The filing says government-issued photo identification. It does not list passwords or payment card numbers.

Did someone steal the data?

The company said it could not rule out unauthorized access or acquisition of files in the bucket. It did not say the data was confirmed stolen.

Should I change my password?

The filing doesn't list passwords as exposed. Changing your password is cheap and fine to do, but a credit freeze matters more for an ID leak.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related guides

All guides
How to opt out of prescreened credit card offers (OptOutPrescreen) optoutprescreen.com Remove yourself from Equifax equifax.com Remove yourself from Experian experian.com Remove yourself from TransUnion transunion.com

Related articles

All articles

What is the dark web? Definition and how it works

What Happens If Your Email Is on the Dark Web – And What to Do Next

How to Get My Information Off the Dark Web

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.