Teachers and Students Targeted in the 453K Record ShowMe Breach

HEROIC analysts identified the ShowMe breach data circulating in underground credential markets during a routine review of education sector leaks. The breach originally occured in August 2017, affecting this U.S.-based educational platform that lets teachers and students create and share interactive lessons primarily through an iPad app. A total of 453,386 user records were exposed, containing email addresses and plaintext passwords, meaning the actual password text was stored with no protection whatsoever and is instantly usable by anyone who obtains the file.

How Exposed Teacher and Student Accounts Get Exploited

Educational platform accounts are partcularly valuable to attackers because teachers and students often use the same email and password combination across school systems, district portals, Google Workspace for Education, and personal accounts. With 453,386 plaintext passwords in hand, attackers can run automated credential stuffing campaigns testing those login pairs across dozens of services simultaneously. A single match gives them access to email inboxes, cloud storage, grade portals, and potentially even payment accounts tied to the same credentials.

What Was Exposed in the ShowMe Breach

• Email Address
• Plaintext Password

Why the ShowMe Breach Puts Educators and Students at Ongoing Risk

Breached educational data does not age out of usefulness. The ShowMe file has been traded and compiled into mass credential lists that attackers continue to use for account takeover attempts years after the original breach. Anyone who used the same password from their ShowMe account on another service remains a target for credential stuffing and account takeover today. If that email address is also a work or school account, the risk extends to institutional systems and sensitive student records. Financial fraud becomes possible whenever attackers gain access to associated payment accounts.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to the servers where a website stores its user information. This can happen through a software flaw, a weak admin password, or an unpatched security vulnerability. Once inside, the attacker copies the entire user table and downloads it. The platform itself may keep running normally, giving users no sign that anything went wrong until the data starts showing up for sale or their accounts begin getting compromised elsewhere.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records to check instantly whether your email address appears in the ShowMe breach or thousands of other known incidents. Visit HEROIC.com to run a free scan and find out whether your credentials are already being traded in underground markets.