Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.computer.security > #6228

Don't Worry, You're Info Is Safe With Us

Cross-posted to 2 groups.

Show all headers | View raw

Education tech giant gets an F for security after sensitive info on 40
million users stolen Chegg it out: Four blunders in four years icon
Jessica Lyons Hardcastle Mon 31 Oct 2022 // 22:54 UTC

Sloppy data security at education tech giant Chegg exposed students and
workers' personal information not once but four times in various ways
over four years, according to the FTC.

In response, the American consumer watchdog today ordered the company to
better protect data, including encrypting sensitive information,
providing multi-factor authentication to users and employees, limiting
the amount of personal information it collects and retains, and training
staff on security practices. Stuff that should have been done a long
time ago.

Additionally, the FTC noted Chegg didn't necessarily notify all of the
40 million users and employees whose private info was exposed during the
four breaches.

So, per an FTC order [PDF], the tech firm also has to notify "each
individual whose unencrypted Social Security number, financial account
information, date of birth, user account credentials, or medical
information was exposed" within the next 60 days.

"Chegg took shortcuts with millions of students' sensitive information,"
Samuel Levine, director of the FTC's Bureau of Consumer Protection, said
in a statement. "Today's order requires the company to strengthen
security safeguards, offer consumers an easy way to delete their data,
and limit information collection on the front end."

Chegg offers a ton of online educational services and products,
including e-textbooks for rent, homework help, and exam preparation,
primarily to high school and college students. It also collects a ton of
personal data, according to an earlier FTC complaint [PDF]. What could
possibly go wrong?

"For example, in connection with its scholarship search service, Chegg
has collected information about a user's religious denomination,
heritage, date of birth, parents' income range, sexual orientation, and
disabilities (collectively, the 'Scholarship Search Data')," it noted.

This should have set off at least a few security and privacy alarms —
and apparently, in 2018, it did. The FTC complaint cited an internal
email from that year in which a Chegg information security employee
described the scholarship search data as "very sensitive."

In addition to the scholarship search data that the tech company
collected and retained, for its online tutoring services Chegg recorded
videos of the students as well as harvesting the usual employment
information from its workers. This includes employees' names, dates of
birth, Social Security numbers, and financial information.

The company stored all of this sensitive employee and student data in
Amazon S3 buckets — and then did a miserable job at keeping intruders
from potentially stealing it.

The rest of the story -
https://www.theregister.com/2022/10/31/chegg_ftc_order/

Back to alt.computer.security | Previous | Next | Find similar | Unroll thread

Thread

Don't Worry, You're Info Is Safe With Us Nomen Nescio <nobody@dizum.com> - 2022-11-01 02:06 +0100

csiph-web