175,339 Toan Hoc 247 Breach: Student Data Exposed

HEROIC analysts found that in April 2020, the Vietnamese online math education platform Toan Hoc 247 suffered a database breach that exposed 175,339 user records. The compromised data included email addresses and password hashes stored using both MD5 and bcrypt, revealing inconsistent security practices that left many student accounts vulnerable to attackers.

Mixed MD5 and Bcrypt Hashing Leaves a Large Student Password Share Crackable

When a platform stores some passwords as MD5 and others as bcrypt, the weaker format becomes the effective security floor for the entire system. Attackers who obtained the Toan Hoc 247 database could quickly crack the MD5-hashed portion of the 175,339 accounts using rainbow tables or GPU-accelerated tools. The cracked credentials are then tested against other Vietnamese education platforms, social media, and email services where students may have reused the same password.

What Was Exposed in the Toan Hoc 247 Breach

• Email Address
• Password Hash (MD5 and Bcrypt)

Why the Toan Hoc 247 Breach Puts Vietnamese Students at Ongoing Risk

Education platforms serving students preparing for national exams hold accounts tied to real identities and school email addresses. These credentials are partcularly valuable for credential stuffing because students commonly reuse passwords across university portals, scholarship applications, and government education services. The breach occured in 2020 but the data continues to circulate on dark web forums, meaning the risk to affected users has not expired.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access through exploited vulnerabilities in web application code, unpatched software, or misconfigured database servers. Education platforms that handle large volumes of student registrations often accumulate years of user data without performing security upgrades, leaving legacy password formats like MD5 in place alongside newer algorithms like bcrypt.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across 400 billion or more compromised records to show you exactly what information of yours has been exposed. Run a free scan at HEROIC to check whether your email appeared in the Toan Hoc 247 breach or any of the hundreds of other incidents tracked in our system.