Cyber Incident Victim: EduCBA
Date:
May 2020
Location:
India
Summary
EduCBA, an online education platform, disclosed a data breach resulting from a system hack that exposed user information including emails, names, passwords, and course activity details. The organization stated financial data remained unaffected due to reliance on third-party payment processors, but provided incomplete specifics regarding the full scope of compromised data beyond referencing "etc." in notifications. As a precautionary measure, the company invalidated all user passwords, though external reports indicated potential inconsistencies in this remediation step. The incident impacted the platform's learner base, necessitating credential updates across affected accounts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around May 21, 2020, EduCBA, an India-based online education platform offering over 2,500 courses to approximately 500,000 learners, experienced a cybersecurity incident involving unauthorized access to its systems. The breach resulted in the exposure of user data, prompting EduCBA to begin notifying affected customers via email on May 22, 2020. The company disclosed that compromised information included email addresses, names, passwords, and records of courses visited, with an unspecified expansion denoted by the term "etc." in their notification. EduCBA explicitly stated that financial data remained secure as payment processing relied exclusively on third-party services PayPal and 2Checkout, which were not implicated in the breach. The organization did not provide technical details regarding the attack vector, intrusion methods, or the duration of unauthorized access prior to detection.
In response to the incident, EduCBA invalidated all user passwords as a precautionary measure and directed account holders to reset credentials through a provided link. The company’s breach notification emphasized this password reset action but did not describe additional containment or forensic measures undertaken. External observations contradicted the completeness of this response, with at least one user reporting on Twitter that their password remained unaffected by the reset initiative. The lack of detailed public disclosure regarding the scope of compromised data—particularly the undefined "etc." category—left uncertainties about the full extent of exposed information. Affected users faced potential risks of credential reuse attacks, necessitating independent password changes across other platforms where EduCBA credentials might have been replicated. BleepingComputer attempted to obtain clarification on the breach specifics but received no reply from EduCBA by the time of reporting.