Threat actor claims leak of 2 million Ocean Edu student records
A threat actor on an underground forum claims to have leaked the student database of Ocean Edu (ocean.edu.vn), an English-language training chain in Vietnam: more than 2 million records, over 4 GB. The actor says it includes names, contact details, national ID numbers, hashed passwords and more than 80,000 photos. The claim is unverified and Ocean Edu has not confirmed an incident; students should change reused passwords.
What happened
A threat actor published on an underground forum a database attributed to Ocean Edu, an English-language training chain in Vietnam, with more than 2 million student records. The actor says it holds names, contact details, national ID numbers, hashed passwords and more than 80,000 photos. DailyDarkWeb reports the claim is unverified and Ocean Edu has not confirmed an incident.
Why it matters
If real, the data exposes students and families to identity fraud and convincing phishing calls or messages posing as the school. Exposed password hashes could fuel attacks on other accounts. With no confirmation from the company, the true scope remains unknown.
What to do
Task threat intelligence and credential monitoring to verify the posted sample. Tell students and parents to change reused passwords and treat unexpected requests for fees, codes or personal details as fraud. Prepare communications in case Ocean Edu confirms the incident.
For the technical team
- Affected
- Base de dados de estudantes da Ocean Edu (ocean.edu.vn), rede de ensino de inglês do Vietnã; mais de 2 milhões de regist · Ocean Edu student database (ocean.edu.vn), an English-language training chain in Vietnam; more than 2 million records and over 4 GB, according to the actor.
- Exploitation
- No confirmed exploitation. Claim published on an underground forum and reported by DailyDarkWeb, which classifies it as an unverified threat-actor claim, not confirmation of a breach.
- Fix
- No fix applicable. Verification of the database authenticity and victim confirmation remain pending.
- Vector
- Method of acquisition not described in the sources. The sample shared by the actor points to an export from an internal student management system.
- More details
- Claimed contents: full names, emails, phone numbers, home addresses, birth dates, national ID numbers, academic records, hashed passwords (online and MS Teams) and more than 80,000 student photos. DailyDarkWeb assesses risk of identity fraud, phishing and credential stuffing, and recommends changing reused passwords and treating unexpected requests for codes, fees or personal details as fraud.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
