According to US-based security firm Cyble, India’s popular ed-tech firm Unacademy was hacked back in January this year and users’ data was accessed. Researchers from Cyble have found a database of around 22 million Unacademy on sale for $2000 on Dark Web.
The data included usernames, email addresses, passwords, date joined, last login date, first and last names, account profile, and account status. Cyble has also added this data to its data breach monitoring service where Unacademy users can check if their email was on the hacked database.
The good thing is that the password was hashed, but it is still advisable to change your password if it was in the hacked database.
Unacademy has responded to this news by saying they are closely monitoring the situation.
“We follow stringent encryption methods using the PBKDF2 algorithm with a SHA256 hash, making it highly implausible for anyone to access the learner passwords. We also follow an OTP based login system that provides an additional layer of security to our learners. We are doing a complete background check and will be addressing any potential security loophole to further our efforts of ensuring a robust security mechanism,” said Unacademy Co-Founder and CTO Hemesh Singh.
The company also claimed that hacked data was just 11 million as opposed to 22 million being reported. No-sensitive data was leaked.
BleepingComputer used this data to contact some of the users to verify if the hacked database was legit. They found that the hacked data is authentic. Hacker also claimed that hacked could have more data but they are just selling user records. Later they also leaked more data that includes profiles and quizzes.
Unacademy is valued at more than USD 500 million. Recently, it also revised USD 110 million in funding from General Atlantic, Sequoia, and Facebook. The company began in 2015 and now hosts more than 1 million videos on its platforms. There are over 10,000 who are creating educational videos on Unacademy.
