Ed-Tech Breach: Chegg Exposed 36.8 Million Student Records

HEROIC analysts recieved intelligence about the Chegg breach database while tracking credential markets that target students and academic platforms. The incident, which dates to April 2018, exposed 36,807,535 accounts from this widely used U.S. education and textbook rental service. The stolen records included email addresses, usernames, first and last names, and password hashes stored using unsalted MD5, one of the weakest password protection methods available at the time.

How Stolen Student Credentials Fuel Identity Theft and Financial Fraud

Education platform accounts are particularly valuable to attackers because students and young adults are seperate targets from typical corporate breach victims. Chegg users often share the same email and password across school portals, financial aid systems, and banking apps. Once an attacker cracks an unsalted MD5 hash, they can attempt to log into any of these accounts, potentially accessing student loan information, tax documents, and direct deposit settings that enable full-scale financial fraud.

What Was Exposed in the Chegg Breach

• Email Address
• Username
• First Name
• Last Name
• Password Hash

Why Unsalted MD5 Hashes Put Millions of Students at Long-Term Risk

Unsalted MD5 hashes are among the easiest password formats for attackers to reverse. Without a salt, identical passwords produce identical hashes, which means pre-computed lookup tables can crack thousands of accounts in minutes. Over 36 million Chegg records remain circulating on criminal marketplaces today, meaning credential stuffing attacks, account takeover attempts, and identity theft tied to this breach are still actively occurring years after the original incident.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to a company's user database, usually by exploiting an unpatched software flaw, a weak administrator password, or a misconfigured server. In a database breach, the attacker copies or downloads the entire user table, which contains account credentials and personal details. That data is then packaged and sold on criminal forums, where buyers use it for automated login attacks across hundreds of platforms.

Check If Your Data Was Exposed

HEROIC offers a free breach scanner powered by a database of more than 400 billion compromised records. If your email appeared in the Chegg breach or any other known data leak, HEROIC will show you exactly what was exposed. Run a free scan today and find out what attackers already know about you.