First, in 2017, Chegg employees fell for a phishing attack, which gave criminals access to employees' direct deposit information.
A year later, a former contractor accessed one of Chegg's S3 databases using an AWS Root Credential, and stole a database containing about 40 million users' data. This included email addresses, first and last names, passwords, and, for some users, their religious denomination, heritage, date of birth, parents' income range, sexual orientation, and disabilities.
Later in 2018, a threat-intel firm notified Chegg that a file containing some of the stolen information was up for sale in an online forum. "Chegg reviewed the file as part of its own investigation, finding it held, among other things, approximately 25 million of the exfiltrated passwords in plain text, meaning the threat actors had cracked the hash for those passwords," according to the complaint. In response, Chegg required about 40 million users to reset their passwords. But it continued to store students' personal information in plain text, we're told.
In 2019, following another successful phishing attack, miscreants stole a senior executive's credentials and used those to access the exec's email inbox, which contained users' and employees' financial and medical information. The email system remained in its default configuration, which meant it didn't require MFA to access inboxes, the complaint said.
