TaiLieu Education Portal Breaches 7.3 Million User Records, Including Unsalted MD5 Password Hashes
What Happened
In November 2019 the Vietnamese education website TaiLieu suffered a data breach that exposed 7,327,477 user accounts. The leaked dataset contained personal identifiers, contact information, and passwords stored as unsalted MD5 hashes. The breach was disclosed to Have I Been Pwned by dehashed.com after the data appeared on a public hacking forum; TaiLieu has not publicly responded.
Why It Matters for Compliance & Audit Readiness
- Shows the risk of weak credential storage; continuous control‑assurance programs must verify that password hashing meets current NIST SP 800‑63B guidance.
- Highlights the need for documented incident‑response evidence; auditors expect timely breach notification and defensible evidence of containment.
- Reinforces the importance of ongoing vendor‑risk monitoring; a single unchecked SaaS provider can introduce systemic exposure across an organization’s trust surface.
Who Is Affected
- Online education platforms and e‑learning SaaS providers.
- Organizations that integrate TaiLieu’s authentication or content APIs.
- Any entity that stores or processes Vietnamese personal data (names, DOB, gender, location, phone).
Recommended Actions
- Inventory all integrations with TaiLieu or similar Vietnamese education services and assess data flow.
- Verify that password storage mechanisms across your environment use salted, adaptive hashing (e.g., bcrypt, Argon2).
- Review breach‑response playbooks; ensure evidence collection and notification timelines align with GDPR, PDPA, and local regulations.
- Request a formal incident‑response disclosure from TaiLieu to confirm remediation steps.
Technical Notes
- Attack vector: Likely web‑application compromise leading to database export; data later shared on a hacking forum.
- CVEs: No specific CVE IDs reported for this incident.
- Data types exposed: Names, usernames, email addresses, dates of birth, genders, geographic locations, phone numbers, and passwords (unsalted MD5 hashes).
Source: https://haveibeenpwned.com/api/v3/breach/TaiLieu