The Sphero Leak Exposed 813,618 US Education Platform Accounts

HEROIC found a database breach affecting Sphero, a U.S.-based educational robotics company whose platform is used by students and educators across the country. The breach occured on September 9, 2023, and was discovered on a public hacking forum where over 813,618 records had been posted. The exposed data includes email addresses, first names, last names, and usernames. Given that Sphero serves schools and children's education programs, the scope of this exposure is wider than the record count alone suggests.

Why This Is Dangerous

Educational platforms are high-value targets for attackers because they hold data on both adults and minors, and their security budgets are often smaller than commercial enterprises. The Sphero breach exposed enough personal information to enable convincing phishing attacks against parents, teachers, and school administrators. Attackers can cross-reference the leaked email addresses with other breached datasets to build detailed profiles on individuals. Even without passwords, the combination of full name, email, and username creates a powerful toolkit for social engineering and identity fraud. Parents should also be concerned that their child's account information may have been accessable to bad actors.

What Was Exposed

• Email Address
• First Name
• Last Name
• Username

Why This Matters

With 813,618 records circulating on hacking forums, this breach has significant reach. Credential stuffing attacks become possible when attackers test these emails against other platforms using previously leaked passwords. Account takeover at an educational institution can expose grade records, personal communications, and in some cases financial data tied to school accounts. Identity theft is a realistic outcome for anyone whose full name and email address appears in the leak. Financial fraud can follow when attackers gain enough personal data to impersonate someone in phishing or account recovery scenarios. The volume of this breach means it will likely be referenced and recombined with other datasets for years.

How a Database Breach Works

In a database breach, an attacker identifies a weakness in a company's web infrastructure or database configuration and uses it to extract stored user data. This can happen through SQL injection, compromised admin credentials, or cloud storage misconfigurations. Once a large dataset like Sphero's is exfiltrated, it is typically posted to underground forums or sold to other threat actors. The Sphero data was discoverd on a well-known hacking forum, meaning it was immediately availible to a large number of malicious actors at no cost, dramatically increasing the risk of follow-on attacks against affected users.

Check If You Are Affected

If you or your child has ever used the Sphero platform, your email address and personal details may be part of this breach. HEROIC has indexed over 400 billion exposed records, and our free breach scanner can tell you in seconds whether your email appears in the Sphero dataset or thousands of other known breaches. Teachers, parents, and school administrators should all check their accounts and update passwords on any service that shares an email with their Sphero login.