Massive E-Learning Data Breach in Spain Exposes 6 Million Users

Hackers Take Aim at Spain's Education Sector

The cybersecurity world has been shaken once again, and this time the epicenter is in Spain. An unnamed Spanish e-learning platform was hit by an attack that put the data of more than 6 million users into the wrong hands. It's yet another reminder that running a virtual school doesn't exempt anyone from the duty to protect its users' digital security.

What Was Stolen, and Where Did It End Up?

According to INCIBE, Spain's national CERT, the stolen database is a goldmine for cybercriminals. It contains:

• Users' full names,
• Email addresses (both personal and work),
• Hashed passwords (using bcrypt),
• Phone numbers,
• Social media profile information,
• Details of completed courses.

To make matters worse, the whole data set has been put up for sale on a popular hacker forum. That opens a Pandora's box. The stolen information can fuel further, more targeted attacks, such as phishing, identity theft and the takeover of accounts on other services.

Response and Recommendations

INCIBE acted quickly and notified both the affected company and law enforcement. However, the platform's name has not been made public, which makes it hard for users to check whether their data is at risk.

This incident should be a wake-up call for everyone. If you use any online learning platform, now is a good time to change your password as a precaution and turn on two-factor authentication (2FA) wherever you can. When it comes to staying safe online, it's better to be safe than sorry!

It is the latest in a series of major data breaches. We previously covered the VoyageSecure breach, which affected 15 million records. Regulations such as the NIS2 Directive require companies to put appropriate security measures in place precisely to prevent incidents like this one.

Source: Security Affairs

Aleksander