Data breaches were missed learning opportunities for ed tech company

Image

An easy step can help protect your online accounts from hackers. Whenever you can, make sure your accounts ask for two credentials to verify your identity when you log in. It’s called multifactor, or two-factor, authentication. The protection is so powerful that the FTC insisted that Chegg, Inc., offer it to users of its online educational services as part of a settlement of an FTC data breach case against it.

According to the FTC, Chegg didn’t use reasonable security measures to protect the personal information of its users — mostly high school and college students — and employees. An FTC complaint charges that Chegg’s lax security resulted in four data breaches from 2017-2020.

One breach, in 2018, exposed 40 million users’ names, email addresses, passwords and, for some, their religion, heritage, date of birth, sexual orientation, disabilities, and parents’ income range, the FTC says. Other breaches exposed employees’ financial, medical, and W-2 information, including birthdates and Social Security numbers. The FTC says that Chegg repeatedly failed to fix the data security problems the breaches revealed, resulting in further breaches.

Under an FTC settlement, Chegg must take steps including offering users multifactor authentication options to secure their accounts. With multifactor authentication, you need a credential, or “factor,” beyond your password or PIN to log into your account. The factor can be something you have, like a one-time verification passcode you get from a security key or by text, email, or from an authenticator app. Or, it can be something you are, like your fingerprint, your face, or your retina.

With multifactor authentication, even if a hacker knows your username and password, they can’t log in to your account without the second credential, making your account far more secure than it would be with just a password for protection.

Under the settlement, Chegg also must put a comprehensive data security program into place, minimize the personal data it collects, and let users delete certain personal information from Chegg’s files.

Learn how to turn on multifactor authentication and other ways to secure your account on our website.

Where this page came from

This page was imported from Federal Trade Commission. Published by the Federal Trade Commission and, as a work of the United States government, in the public domain; material credited to others is left out.

Nobody has written it yet — it is the source material at a new address, which is why search engines are asked to skip it and why no one earns from it. It is up for grabs: take it on, and it is yours to rewrite and to earn from.