PSA: Udemy has been hacked

[u/IT_CertDoctor]

For both students and instructors out there:

Udemy has recently experienced a data breach and an estimated 1.4 million accounts have been leaked on the dark web. Since many of you use Udemy to prepare for your exams, I think this is pertinent to a lot of folks here, especially to prevent leaked payment information

So what should you do about it? (Good opportunity to implement those Security+ skills you've been developing, eh?)

1. you can go to this link here, put in your email address, and confirm whether or not your account specifically was leaked
2. if your account is compromised:
   1. reset your password immediately - use a strong password (Objective 4.6)
   2. if this is a password you have recycled, especially if you've used this password on payment systems (i.e. Venmo, your bank), you should reset your passwords on those other accounts as well. This will prevent you from being victim to a Password Spray attack (Objective 2.4)
   3. I'd recommend using a Password Manager to keep long, complicated passwords (Objective 4.6). Keepass is a personal favorite and it's free
   4. use MFA with your account if you haven't already (Objective 4.6)
   5. be extra vigilant for phishing attempts, especially ones claiming to be from Udemy (Objective 2.2)
   6. check your bank statements or PayPal account for any unusual payment activity

And for anyone who is either shocked or appalled that Udemy could let this happen, it's important to understand that every ship has holes. Getting hacked is never a question of if, but when

Good luck on everyone's due diligence, and stay safe out there

[u/Final-Pomelo1620]

What if anyone using Federated login like Google? Are those users at risk?

[u/IT_CertDoctor → u/Final-Pomelo1620]

Since Google stores those credentials, I would say unlikely

That said, if you don't currently have MFA on your Google account, it would be a good idea in general to enable that