Inside the DQLab Database Breach: How 132K Education Records Were Stolen

HEROIC analysts identified a database breach affecting DQLab, an Indonesian online education platform. The breach occured in April 2021 and exposed 132,275 user records. The data leaked was unusually broad for an education site, covering email addresses, phone numbers, hashed passwords, first and last names, IP addresses, and birthdays. This combination of personal identifiers is partcularly valuable to attackers building targeted phishing profiles.

Identity Theft and Phishing: What Attackers Can Do With DQLab Data

With full names, birthdays, phone numbers, and email addresses in hand, attackers can craft highly convincing phishing messages. Even though passwords were hashed with bcrypt, the surrounding PII is enough to enable social engineering, SIM swapping, and account recovery attacks. Victims may beleive they are receiving legitimate communications because the attacker already knows so much about them.

What Was Exposed in the DQLab Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name
• IP Address
• Birthday

Why the DQLab Breach Is a Long-Term Identity Risk

Breach data from education platforms is recieved by dark web buyers and combined with data from other leaks to build richer victim profiles. When a threat actor merges names, birthdays, phone numbers, and email addresses from DQLab with credentials from other breaches, the result can enable account takeover, identity theft, and financial fraud across many services simultaneously.

How a Database Breach Works

A database breach occurs when an unauthorized party gains access to a backend data store, often through SQL injection, exposed credentials, or misconfigured cloud storage. The attacker then copies the entire dataset. In DQLab's case, the database contained rich personal information across 132,275 accounts, all of which became accessible to anyone who obtained the leaked file.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion records, including the DQLab breach. Run a free scan at HEROIC now to find out whether your personal information or credentials are circulating on the dark web.