Unacademy, one of India’s largest online learning platforms was affected by a data breach when a hacker attained access to its database and around 22 million user records were put up for sale in the Dark Web.
Unacademy which has a valuation of more than $500 million has over 14K teachers, a million video lessons, and more than 20 million registered users or learners.
Cyber intelligence company Cyble Inc. discovered on 3rd May that a cybercriminal had started to sell an Unacademy user database consisting of 20 million accounts for $2,000.
The database which are advertised as 20 million actually contains a total of 21,909,707 user records. These records include usernames, SHA-256 hashed passwords, date joined, last login date, email addresses, first and last names, and whether the account is active, a staff member, or a superuser.
The last account created in the database is from January 26th, 2020, which shows that the hacker breached Unacademy’s systems around that time.
It is found that numerous accounts using corporate emails existed in the database as well which includes accounts from Wipro, InfoSys, Cognizant, Google, and Facebook.
If these users used the same passwords on their corporate network as well, then it would let the attacker to easily gain access to these networks also
Hemesh Singh, Co-founder and CTO of Unacademy, confirmed the breach but stated that only 11 million users were affected and that no passwords were exposed.
The threat actors have alleged to Cyble’s researchers that they have stolen the entire database, but are only putting the user records up for sale at this time.
However, at the moment it is not known what this data includes.
All the registered Unacademy learner or educator are highly recommended to change their site passwords immediately.
Those users who use the same password at other sites are also suggested to change their password to a unique one and not to reuse the passwords.
The users must be vigilant about phishing mails that claim to be from Unacademy.
Cyble has acquired the database and added the user records to its data breach monitoring service amibreached.com.
The Unacademy users can make use of this service to verify if their account was leaked as part of this breach.