Chegg

Disclosed Sep 26, 201840,000,000 affectedSettled

Four breaches from 2017 to 2020 exposed 40M users' data; FTC order

A former contractor used a shared, fully privileged AWS access key to take 40 million Chegg user records in 2018, and three phishing breaches exposed more customer and employee data including financial, medical and Social Security information. The FTC's 2022 order requires a security program and data minimization.

What is known

People affected	40,000,000 (as reported by the organization)
Disclosed	Sep 26, 2018
Happened	Apr 28, 2018
Attack	Hacking
Data exposed	EmailsNamesPasswordsPhone numbersAddressesFinancialHealthSocial Security numbers
Sector	Education · US
Status	Settled
Lawsuit or fine	FTC consent order (Oct 2022); no monetary penalty
Check your email	Have I Been Pwned

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Chegg

Aggregatorhaveibeenpwned.com

Have I Been Pwned: Chegg

Newstechcrunch.com

Chegg resets 40 million user passwords after data breach

Newstechcrunch.com

FTC schools edtech giant Chegg over careless cybersecurity practices

Official noticemaine.gov

Maine Attorney General breach notice archive: Chegg

Notices filed

Residents of CASep 26, 2018

California AGCount not stated

TotalSep 26, 2018

Research40,000,000 people

Residents of MESep 26, 2018

Maine AG75,000 people

Accounts in the dataAug 16, 2019

Have I Been Pwned39,721,127 people

Other breaches at Chegg

Breach, details not statedBreach notice filed with the California AG, details not stated.USApr 27, 2020

History of this record

source2026-09-25

empty to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsxby backfillSource

status2026-09-25

confirmed to settledby seedSource

lawsuit2026-09-25

empty to FTC consent order (Oct 2022); no monetary penaltyby seedSource

sector2026-09-25

tech to educationby seedSource

attack2026-09-25

unknown to hackingby seedSource

data_types2026-09-25

["emails","names","passwords","phone","addresses"] to ["emails","names","passwords","phone","addresses","financial","health","ssn"]by seedSource

records_basis2026-09-25

hibp to organizationby seedSource

records2026-09-25

39721127 to 40000000by seedSource

summary2026-09-25

In April 2018, the textbook rental service Chegg suffered a data breach that impacted 40 million subscribers. The exposed data included email addresses, usernames, names and passwords stored as unsalted MD5 hashes. A small number of records to A former contractor used a shared, fully privileged AWS access key to take 40 million Chegg user records in 2018, and three phishing breaches exposed more customer and employee data including financial, medical and Social Security informatiby seedSource

title2026-09-25

empty to Four breaches from 2017 to 2020 exposed 40M users' data; FTC orderby seedSource

hibp2026-09-25

empty to Cheggby backfillSource

sector2026-09-25

other to techby backfillSource

data_types2026-09-25

[] to ["emails","names","passwords","phone","addresses"]by backfillSource

records_basis2026-09-25

empty to hibpby backfillSource

records2026-09-25

empty to 39721127by backfillSource

occurred2026-09-25

empty to 2018-04-28by backfillSource

summary2026-09-25

empty to In April 2018, the textbook rental service Chegg suffered a data breach that impacted 40 million subscribers. The exposed data included email addresses, usernames, names and passwords stored as unsalted MD5 hashes. A small number of recordsby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Chegg