A recent security breach on the education platform called Edmodo has resulted in a theft of millions of user account details. The hacker responsible for the theft is now offering to sell this data on the dark web.
Edmodo is widely used by teachers, students, and even the students’ parents. They use it for assigning homework, working on lesson plans, planning activities and more. Supposedly, this organization has over 78 million members.
The notice on the Edmodo’s website says: “Thanks to those who guided and supported us in the beginning, we’re now the number one K-12 social learning network in the world, dedicated to connecting all learners with the people and resources they need to reach their full potential.”
The data that was stolen from the website includes usernames, passwords, and even email addresses of the Edmodo’s members. However, the passwords have been hashed, and to do this, the website has used the robust bcrypt algorithm, as well as the random character strings called salt. This means that hackers will still have trouble when it comes to actually obtaining the login credentials. Another good thing is that not all of the stolen records contain an email address of the user.
One of the for-profit breach notification websites called LeakBase has contributed over two million of the stolen user records as a sample. This included usernames, passwords, as well as email addresses. The data was then verified by attempts to create new accounts via provided emails. Every one of the provided emails was already registered on Edmodo, which confirmed that the sample provided by LeakBase is genuine.
The rest of the data is currently on sale for around $1,000 on the dark web marketplace, and it was posted there by the user under the name of nclay. This user claims to have 77 million accounts, 40 million of which include the email addresses. According to nclay, these accounts were stolen last month. However, the vendor didn’t respond to requests concerning clarification.
Mollie Carter, company’s VP of Marketing and Communications, has stated that Edmodo is aware of the potential security incident. She also said that the users’ privacy is of the greatest importance to the company and that they’re currently investigating this breach. Apparently, the report was taken very seriously, and for now, not much more is known about how the breach occurred. Hopefully, the ongoing investigation will soon shed some light on the incident.
