Chegg Data Breach Exposes 39.7 Million Accounts, Including Unsalted MD5 Password Hashes
What Happened – In April 2018 the textbook‑rental platform Chegg suffered a breach that compromised roughly 40 million user records. Exposed data included email addresses, usernames, full names, and passwords stored as unsalted MD5 hashes; a subset also contained physical addresses and phone numbers.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage – a core control objective around protecting authentication secrets and ensuring proper hashing practices.
- Highlights the need for continuous evidence that password policies, hashing algorithms, and access restrictions are enforced and auditable.
- Aligns with Verisq’s Access Controls capability, which helps organizations continuously monitor credential‑management controls and produce defensible audit artifacts.
Who Is Affected – Primarily the education‑technology sector and any SaaS providers handling large volumes of user credentials.
Recommended Actions
- Replace unsalted MD5 hashes with modern, salted algorithms (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for all privileged and user accounts.
- Conduct a credential‑storage audit, map findings to the “protect authentication secrets” control objective, and collect evidence for audit readiness.
Technical Notes – The breach appears to have resulted from a vulnerability in how credential data was stored and accessed, exposing weak hashing (unsalted MD5) and insufficient access restrictions. No specific CVE was disclosed. Source: [Have I Been Pwned – Chegg breach]