Chegg—Chegg data breach exposed 40 million users' personal data including passwords stored in plain text
In April 2018, Chegg suffered a massive data breach exposing 40 million users' names, emails, addresses, and passwords - with 25 million passwords stored in plain text. The breach also exposed sensitive scholarship data including sexual orientation and disabilities. FTC investigation revealed Chegg had no written security policy, used weak encryption, shared a single AWS admin key across employees/contractors, and required no MFA for database access.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Data Security | -against | primary | -1.00 |
| User Privacy | -against | primary | -1.00 |
| Overall incident score = | -0.590 | ||
Score = avg(topic contributions) × significance (critical ×2) × confidence (0.59)× agency (negligent ×0.5)
Evidence (1 signal)
FTC details Chegg data breach affecting 40 million users
FTC action revealed Chegg's security failures that led to breach exposing 40 million users' data, including passwords stored in plain text.