4x the Size of a Sold-Out Stadium: The iD Tech Breach Exposed 414,940 Records Including Kids’ Data

HEROIC analysts identified the iD Tech breach on July 3, 2023, when a dataset from the youth technology education company appeared on a popular hacking forum. The dump contained 414,940 records and what made it particularly alarming was the combination of data types exposed: plaintext passwords alongside birthdates, full names, and email addresses. For a platform that serves children and teenagers, this combination creates risks that extend far beyond a typical credential breach.

Plaintext Passwords and Birthdates From a Children's Education Platform Are a Dangerous Combination

Attackers who recieved this dataset did not just get login credentials. They got verified age data tied to real names and email addresses. That combination is valuable for identity theft targeting minors, who often have clean credit histories that go unchecked for years. Plaintext passwords mean those credentials are immediately usable for account takeover on any other service where parents or teens reused the same login.

What Was Exposed in the iD Tech Breach

• Email addresses
• Plaintext passwords
• First names
• Last names
• Birthdates

Why Breaches Involving Minors Carry Long-Term Identity Theft Risk

Data breaches involving children are seperate category of harm. A minor whose name, birthdate, and email address are in circulation on dark web markets may not discover the damage until they apply for a credit card or loan years later. In the meantime, that data can be combined with other breached records to build synthetic identities or used for targeted fraud against parents. The iD Tech breach is more than four times the size of the average NFL stadium audience, meaning hundreds of thousands of families were affected in a single event.

How Plaintext Password Breaches at Education Platforms Work

Education technology platforms often handle rapid user growth without matching investment in security infrastructure. When passwords are stored in plaintext rather than properly hashed, a single database compromise exposes every account simultaneously. Credential stuffing attacks then test those login pairs across hundreds of other services in automated waves. Families that used the same password for iD Tech and for email, banking, or streaming accounts are all at risk from a single breach that occured in one place.

Check If Your Data Was Exposed

If your family had an iD Tech account, your email, password, and personal details may already be in active use. HEROIC's free scanner checks your email against 400 billion-plus compromised records to show you every breach you have appeared in. Scan your email for free at HEROIC.com and find out where your data has been since the iD Tech breach.