In this article, we will give an overview of the largest breach of children’s data: the Edmodo data breach.
A large data of 11.7GB and 77 million users of Edmodo was exposed. It happened way back in April 2017. And the hackers posted the data for sale on the dark web.
What happened? And who were affected?
What is Edmodo?
Edmodo is a network of educational content. It helps many students and teachers in K-12 schools.
Moreover, it allows teachers to do the following features:
- share lessons
- give quizzes and homework
- communicate with students and parents
Edmodo Data Breach
Edmodo discovered the breach on May 10, 2017. And they quickly informed the users two days after.
Furthermore, it exposed a total of 77,010,322 unique users. Thus, experts believe that it was the biggest children’s data breach.
But, Edmodo reassured the users that the possibility of account takeover is the only medium. Why? The passwords are still protected with a hashing function.
Still, some reports showed that the data from Edmodo was being sold on the black market. And most of the time, it is easy to know the full name of the children.
The exposed information
Hackers got the following data:
- Data dump of 11.7GB file
- 77,039,963 lines
- 77,010,322 unique user accounts
- 43,966,537 emails
- 75,626,136 hashed passwords and salts
Hackers posted it for sale on a dark web marketplace called Hansa. It only costs $1000.
How it happened
The hackers used two Phyton attack functions. One is a malicious .exe file and also a bootloader.
Then, the IP addresses started web attacks. And id signatures captured the data.
Users confirmed it
There are tweets about the Edmodo alert. Users said that they received a notification email from Edmodo.
Also, the emails of the users are included in the exposed data dump.
The risk
Hackers steal these data for credential stuffing. It is a type of attack in cybersecurity.
These hackers try to login to other websites using the same email and passwords. Then, they test if it is correct.
Now, we are all human. So, maybe some of us use one password for every website or service. Why? We cannot remember all the complex passwords!
Thus, if a hacker got hold of our Edmodo data, they can log in to our other websites, too.
Moreover, the password level of Edmodo is only a medium level password. Unlike using bank accounts where we use very high-level passwords.
Edmodo did a great job
Breaches are common. And we have to give Edmodo some credit. Why?
They give strong security to the passwords. And they quickly informed their users.
The company’s vice president also commented about the incident. He said that the privacy of its users is very important. Also, they said that they are seriously solving the problem.
Besides, they reached out to the government for help. They also hired the leading security experts for the investigation.
What you can do
In their email, Edmodo advised its users to change their passwords as soon as possible.
Also, this can serve as a lesson for us. To not reuse the same password over and over again.
