FTC alleges Chegg ed tech company exposed data of 40 million users

The Federal Trade Commission has filed a complaint against Chegg, accusing the education tech provider of “careless” security practices that compromised personal data since 2017. The company reportedly exposed sensitive info for roughly 40 million customers in 2018 due to a former contractor accessing a third-party database using their login credentials. This included names, email addresses, passwords, and even personal details like religion, sexual orientation, and parents’ income ranges. The information was later found for sale on the online black market.

Security Lapses and Allegations

The FTC alleges that Chegg failed to implement “commercially reasonable” safeguards, allowing employees and contractors to use a single sign-in, lacking multi-factor authentication, and not scanning for threats. Personal data was stored in plain text and encrypted with outdated and weak methods. Additionally, Chegg did not have a written security policy until 2021 and did not provide sufficient security training despite previous phishing attacks.

Response and Compliance

Chegg has agreed to comply with a proposed order from the FTC to address these issues. The company will define the information it collects, limit the scope of collection, implement multi-factor authentication, and establish a comprehensive security program with encryption and training. Customers will have access to their data and can request its deletion. Chegg insists that data privacy is a top priority and has cooperated with the FTC to improve its security practices.