The On Thi Online Breach Exposed 335,637 Vietnamese Student Accounts

HEROIC analysts identified the On Thi Online breach, which occured in July 2020 and exposed 335,637 user records from a Vietnamese exam preparation portal serving secondary and high school students. The leaked data included email addresses and MD5 password hashes, putting a generation of Vietnamese students at risk of credential theft.

How Stolen Student Email Credentials Enable Targeted Phishing

Email addresses tied to student accounts are partcularly valuable to attackers because they are often reused across school portals, social platforms, and personal services. With MD5 password hashes that are accessable to cracking tools, attackers can authenticate to multiple services and launch targeted phishing campaigns against young users who may not recognize the threat.

What Was Exposed in the On Thi Online Breach

• Email Address
• Password Hash

Why the On Thi Online Breach Puts Vietnamese Students at Long-Term Risk

Many users of this now-defunct portal beleive their data disappeared along with the site. In reality, the database was recieved by threat actors in 2020 and continues to circulate in credential markets. Students who reused those passwords on other accounts remain exposed years after the platform shut down.

How Database Breaches Work

A database breach occurs when unauthorized parties extract records from a site's backend data store, typically exploiting weak server configurations or unpatched vulnerabilities. Attackers download user tables containing login credentials and personal details, then distribute them through dark web forums and private Telegram channels for use in credential stuffing and phishing operations.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across 400 billion-plus compromised records to tell you instantly whether your email address was part of the On Thi Online breach or any other known data leak. Run a free check now to protect your accounts.