Chegg Data Breach (2018): What Was Exposed & What To Do

People whose information was involved in the Chegg incident face the possibility that their email addresses, usernames, and password hashes are now available to others. A smaller subset of records also included names, physical addresses, or phone numbers, which can increase the chance of targeted follow-on contact or account misuse. The practical effect depends on whether individuals reused the exposed passwords elsewhere and on how quickly they change credentials after learning of the event.

What happened

On April 28, 2018, Chegg reported a data breach that affected 39.7 million subscribers. The exposed information included email addresses, usernames, names, and passwords stored as unsalted MD5 hashes. A small number of records also contained physical addresses or phone numbers.

No further details on the method of access, the duration of the intrusion, or the total volume of data removed have been made public.

How a breach like this happens

Incidents involving customer databases often begin with an attacker obtaining entry through a vulnerable application, a compromised administrative account, or an exposed server. Once inside, the attacker can copy tables that store user credentials and profile information.

Password data stored with weak or unsalted hashing can be processed offline at scale, allowing attackers to recover plaintext passwords for accounts that used common or reused values. The resulting lists are sometimes shared or sold, extending the window during which the credentials remain useful.

About Chegg

Chegg operates an online textbook rental and education-services platform that requires users to create accounts with contact details and authentication credentials. Organizations in this sector routinely hold large volumes of subscriber records that include both login information and limited personal identifiers.

When such records are exposed, the combination of email addresses and password hashes can be tested against other services, amplifying the reach of the original incident beyond the original platform.

What data was at risk

The breach notification listed the following categories of information as exposed: email addresses, usernames, names, passwords stored as unsalted MD5 hashes, and, in a small number of cases, physical addresses or phone numbers. The exact contents of every record remain unconfirmed beyond these categories.

The real-world impact

Individuals may encounter increased volumes of phishing messages or attempts to access other accounts that share the same password. Organizations that experience such disclosures can face regulatory scrutiny, customer-support costs, and loss of trust, even when the full scope of downstream misuse is difficult to measure.

Because the passwords were stored without salting, any recovered hashes could be matched more efficiently against common password lists, raising the likelihood that some accounts become usable by third parties.

What to do if you're exposed

Anyone who held a Chegg account at the time should change the password on that account and on any other service where the same password was used. Enabling multi-factor authentication on important accounts adds a layer that reduces the value of a leaked password alone.

Monitor email accounts for unusual login attempts and consider using a password manager to generate and store unique credentials going forward.

• Change the Chegg password and any reused passwords immediately.
• Enable multi-factor authentication wherever available.
• Watch for phishing messages that reference Chegg or use the exposed email address.
• Run a free exposure scan of your email address to check whether it appears in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.