Chegg data breach (2018)

In April 2018, the U.S. education-technology company Chegg — known for textbook rentals, homework help and online tutoring — suffered a data breach affecting approximately 40 million registered users. Chegg disclosed the incident in a September 2018 SEC filing, and the breach later became the centerpiece of a 2022 Federal Trade Commission enforcement action that cited a pattern of repeated security failures.

What happened

An unauthorized party gained access to a Chegg company database around late April 2018. Chegg said it learned of the intrusion on 19 September 2018 and disclosed it days later in a Form 8-K, estimating that data on roughly 40 million active and inactive users had been accessed. The company initiated password resets for affected accounts.

What was exposed

The compromised records included names, email addresses, usernames, and passwords stored as unsalted MD5 hashes — a weak scheme highly vulnerable to cracking. A smaller subset of records also contained shipping addresses and phone numbers. Have I Been Pwned indexed 39,721,127 unique accounts from the dataset.

The FTC action

In October 2022, the FTC charged Chegg over its security practices, noting the company had suffered four separate breaches between 2017 and 2020. The complaint described basic failures: storing data without adequate encryption, lacking multi-factor authentication, providing no meaningful security training, and not adopting a written security policy until January 2021. The 2018 breach was tied to login credentials that gave broad database access; earlier incidents stemmed from phishing of employees.

The FTC noted the exposed data across these incidents went beyond logins — it included Social Security numbers, financial information, and, for some users, sensitive data such as religion, sexual orientation, disabilities and parents' income collected via a scholarship application service.

The order required Chegg to limit data collection, allow users to access and delete their data, and implement a comprehensive information-security program including multi-factor authentication and encryption.

Why it matters

Chegg became a high-profile example of regulatory consequences for chronic security neglect. The case showed that even an education brand handling vast amounts of sensitive student data could rely on unsalted MD5 and lack MFA for years. The FTC's order — emphasizing data minimization and mandatory MFA — set a template for how the agency would pursue companies whose breaches stemmed from foundational hygiene failures rather than sophisticated attacks.