Edmodo

An attacker stole the account details of tens of millions of Edmodo users, the education platform widely used in K-12 classrooms, and put the data up for sale on a dark web marketplace. The indexed dataset for this breach contains roughly 43.9 million records, most of them tied to email addresses and usernames, along with about 6.7 million password entries. The team estimates the breach occurred on May 11, 2017.

May 11, 2017: Motherboard reported that a hacker using the alias "nclay" was selling data from roughly 77 million Edmodo accounts on the dark web marketplace Hansa for just over $1,000, and that breach notification site LeakBase verified a sample of more than two million records.

May 17, 2017: Edmodo confirmed the security incident, saying it had retained information security experts, reported the matter to law enforcement, and had no indication that user passwords had been compromised.

What Information Was Compromised?

Our analysis found the following data types in this breach: email addresses, usernames, and password entries.

Reporting at the time, including Motherboard's verification of a sample through LeakBase, described the passwords as hashed with the bcrypt algorithm and salted, a combination that makes recovering the original passwords substantially harder. Edmodo itself pointed to the same protections in its public statement. Not all records included an email address, according to reporting based on the sample reviewed in 2017.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

The main risk from this breach is account compromise, not identity theft. Email addresses and usernames alone can feed targeted phishing, where a scammer poses as Edmodo or another service to trick people into handing over passwords. Because the audience included students, some of them minors, the presence of children's account data raises additional concerns for parents and schools.

The bcrypt hashing and salting limit the direct usefulness of the password entries, but hashing is not a guarantee. Weak passwords can still be recovered given time and computing power, and any cracked credentials could be reused against other sites if the same password was used elsewhere.

What Is Edmodo Doing in Response?

Edmodo acknowledged a "potential security incident" shortly after the report surfaced. In a statement quoted by Motherboard and Education Week, the company said it retained information security experts, reported the incident to law enforcement, and had "no indication at this time that any user passwords have been compromised," citing the bcrypt hashing and salting of stored passwords. The company said it would share additional information with users as its investigation progressed.

What Should You Do If You Were Affected?

If you had an Edmodo account around 2017, take these steps:

Change your Edmodo password. Do this even if the account is dormant, and pick a password you do not use anywhere else.

Check other accounts for password reuse. If you used the same password on email, banking, social media, or school-related services, change those as well.

Watch for phishing. Be skeptical of emails claiming to come from Edmodo or your school that ask you to log in or provide personal details. Go directly to the site rather than clicking links in messages.

Be alert on student accounts. Parents and teachers should review children's accounts, check for unfamiliar activity, and remind students not to share login details.

Enable extra protections where offered. If a service linked to your Edmodo email offers two-factor authentication, turn it on.