Unacademy, India’s Largest e-Learning Portal Hacked; 2 Crore Passwords, Emails Selling For $2000

Unacademy, the largest education platform, was hacked and a database of over 2 crore users was out on sale on the dark web with contacts of employees of Wipro, Infosys, Cognizant, Google and its investor Facebook, according to Cyble, a US-based security firm.

Read to find out more…

Unacademy Hacked, User Accounts on Sale on Dark Web!

The Bangalore-based company in a span of 6 months has helped over 300,000 students with over 2,400 online lessons and specialized courses on cracking various competitive examinations.

Unacademy company suffered a breach in January, 2020 and the perpetrator said he had access to the entire database. On May 3rd, 2020, Cyble Inc. discovered that the perpetrator had begun to sell an Unacademy user database containing over 2 crore accounts for $2,000. 

According to Cyble the database includes usernames, emails addresses, passwords, date joined, last login date, first and last names, account profile and account status (whether the account is active).

Cyble said that it is unable to confirm who else might have access to this data. The threat actor also mentioned to Cyble researchers that the group is currently selling the user accounts only. The Cyble team is continually monitoring the situation for any key developments. 

Hemesh Singh, Co- Founder and CTO, Unacademy in a statement to ET said, “As per our internal investigations, email data of around 11 million users has been compromised as against 22 million stated in reports. This is on account of only around 11 million email data of users available on the Unacademy platform. We have been closely monitoring the situation and would like to assure our users that no sensitive information such as financial data or location has been breached. Data security and protection of our users is of utmost importance to us and we are doing everything possible, to ensure no personal information is compromised. We follow stringent encryption methods using the PBKDF2 algorithm with a SHA256 hash, making it highly implausible for anyone to decrypt passwords. We also follow an OTP based login system that provides an additional layer of security to our users. “

What Should You Do?

Cyble recommended that registered Unacademy learners and educators immediately do the following:

1. Change their passwords on the site
2. Change passwords of any other account with a similar password pattern.
3. Implement multi-factor authentication wherever possible.
4. Avoid using their corporate email addresses on third party services where possible
5. Closely monitor their financial transactions records to detect any anomalies
6. Register on amibreached.com, a data breach monitoring platform by Cyble and their social media channels (blog) to gain new information/updates regarding this attack, and many others we are tracking actively. 

The firm confirms of seeing the accounts/records with domain names from Infosys, TCS, Cognizant, Reliance Industries, TCS, HDFC, Accenture, ICICI, SBI, Canara Bank, Bank of Baroda, Punjab National Bank and several other large organisations. 

It has urged the organisations to get in touch and learn more about the matter. Furthermore, the concerned organisations can also get some information from AmIBreached.com