Ajarn Data Breach (2018): What Was Exposed & What To Do

Inside the incident

The breach was first reported on 13 December 2018 and affected 266,000 accounts. In September 2021 Ajarn confirmed the incident and provided a dataset containing email addresses, names, genders, phone numbers and additional personal details. Hashed passwords were also present in the exposed material. No further technical details on the method of access or the duration of unauthorised activity have been disclosed.

How a breach like this happens

Incidents involving online service providers commonly begin with an attacker obtaining access to a user database through stolen credentials, an unpatched vulnerability or misconfigured storage. Once inside, the actor can copy tables that hold account information and any associated profile fields. The data may then be offered or published on forums and leak sites. Organisations often learn of such events only after the material appears in public breach repositories or is reported by third parties.

About Ajarn

Ajarn operates a platform that connects English-language teachers with schools and students in Thailand. Sites of this type maintain user accounts for job seekers and employers, storing details required for registration, job applications and communication. A breach at such a service therefore touches both professional and personal information that users submitted in the course of seeking or offering employment.

What was likely exposed

The confirmed dataset includes dates of birth, education levels, email addresses, genders, geographic locations, job applications, marital statuses and names. Phone numbers and hashed passwords were also present. The precise scope of every field contained in the original database remains unconfirmed beyond the material submitted to Have I Been Pwned.

Why it matters

Exposure of names, contact details and employment-related records can lead to increased phishing, unwanted contact or misuse of professional history. Hashed passwords, if weak or reused, may be subject to offline cracking attempts. For the organisation, the incident highlights the long-term retention of user data and the consequences when that data later becomes public.

Were you affected?

Individuals can check whether their email address appears in this or other known breaches by using a free exposure scan service. If an account is listed, changing the password on Ajarn and any other site where the same password was used is a prudent first step. Enabling multi-factor authentication on active accounts further reduces the chance of unauthorised access.

AICompiled with AI assistance from public sources and published under our editorial standards.