Incident Details

In April 2018, the educational platform Chegg Inc. suffered a breach leading to the exposure of sensitive data on over 40 million users. A former contractor used AWS root credentials to exfiltrate the data.

Incident

Details of the Incident

In April 2018, Chegg allowed a former contractor to retain access to their AWS Account using root credentials. No multi-factor authentication was enabled for the account. Additionally, Chegg neglected to encrypt employee and user information and used a weak hashing algorithm for the user passwords.

Using the AWS Root Credentials, the former contractor exfiltrated a database containing personal information of approximately 40 million users of the Chegg platform. The exposed personal information included the S3 User Data consisting of users’ email addresses, first and last names, passwords, and, for certain Chegg users, their Scholarship Search Data, consisting of their religious denomination, heritage, date of birth, parents’ income range, sexual orientation, and disabilities. … Had Chegg employed reasonable access controls and monitoring, it would have likely detected and/or stopped the attack more quickly.¹

In September 2018, a threat intelligence vendor discovered an online forum containing 25 million user passwords in plain text. In response, Chegg required 40 million customers to reset their passwords.

Timeline

Attribution / Perpetrator

According to the FTC Complaint¹, an unnamed former contractor was responsible for using the root credentials to access the personal information.

Long-term impact

The FTC Ordered Chegg to implement a proper security program³, including training for all employees. Chegg must also offer MFA to all users⁴ and submit to regular third-party assessments⁵. The order also states that users must be allowed to access their own data and have the ability to delete their accounts when desired.

Summary of Coverage

Chegg: Letter of notice to Users - September 19, 2018
SEC: FORM 8‑K Disclosure of Security Event- September 25, 2018
Reuters: Judge orders Chegg Breach Cases sent to arbitration - April 18, 2020
Class Action: Class Action Lawsuit Keller vs Chegg - November 8, 2022
FTC: Official Complaint against Chegg Inc - October 31, 2022
New York Times: Chegg Statement to the New York Times - October 31, 2022
FTC: Final Decision on Chegg Breaches - January 26, 2023
FTC: Official Press Release - January 27, 2023

Cloud Security lessons learned.

The cloud security issues outlined here were part of the FTC’s complaint against Chegg (Paragraph 9, pg2-3):

• Chegg did not issue individual access credentials to each employee. All employees and contractors used the same shared set of credentials.
• Chegg did not use IAM for access to their customer data in S3, instead, they used the root account which has been against AWS best practices for several years prior to the Chegg breach.
• Chegg did not require MFA on the root AWS account.
• Chegg did not rotate access keys for access to S3.
• Chegg “failed to adequately monitor its networks and systems for unauthorized attempts to transfer or exfiltrate users’ and employees’ personal information”.