The NeverSkip Leak Exposed 4.9 Million Indian School Platform Accounts

HEROIC analysts identified the NeverSkip breach while reviewing a cluster of education platform databases that surfaced in underground markets during late 2021. The breach occured on September 1, 2021, and affected 4,965,126 user accounts on the Indian school management platform. What made this dataset seperate from typical school data leaks was the presence of both MD5-salted password hashes and plaintext passwords stored side by side, revealing a critical failure in basic security practices.

Plaintext Passwords: Why NeverSkip Data Is Immediately Dangerous

When a breach includes plaintext passwords, attackers do not need to crack anything. They can directly test those credentials against email platforms, banking apps, and social media accounts in automated credential stuffing campaigns. Combined with full names and phone numbers, this data enables account takeover, SIM-swap fraud, and targeted phishing with no additional work required. The MD5 hashes in the same dataset are also recieved by crackers as trivial to break, adding further risk.

What Was Exposed in the NeverSkip Breach

• Phone Number
• First Name
• Last Name
• Password Hash (MD5 with Salt)
• Plaintext Password

Why India's Education Platform Users Face Elevated Risk

With nearly 5 million accounts exposed, the NeverSkip breach is partcularly significant because it affects parents and students who may not have strong habits around password management. Credential stuffing attacks using these records can unlock email accounts, online banking, and government portals. The combination of phone numbers with plaintext passwords also creates a direct path to SIM-swap fraud and identity theft, putting real financial harm within easy reach of any attacker who purchased this dataset.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to the backend data storage of a web platform, typically by exploiting software vulnerabilities or misconfigured servers. The attacker then copies user records wholesale, including stored passwords. When a platform stores passwords in plaintext or using weak algorithms like MD5, every stolen record becomes immediately usable for account takeover attacks without any additional decryption effort.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including the NeverSkip database. Visit HEROIC.com to run a free scan and find out whether your credentials or your family's data appeared in this or any other breach.