Threat actor claims to sell 4.8 million Nomad Education accounts
A threat actor on an underground forum claims to be selling data on about 4.8 million accounts from Nomad Education, a French-language revision app. The claim is unverified, with no field list, sample, or price visible, and Nomad Education has not confirmed an incident. Users should change reused passwords and be wary of unsolicited messages referencing the app.
What happened
A threat actor on an underground forum claims to be selling data on about 4.8 million accounts from Nomad Education, a free French-language revision app. The claim has not been independently verified and the company has not confirmed an incident. The listing first appeared in mid-October and has recently resurfaced.
Why it matters
The app serves school pupils from primary school to higher education, so a genuine dataset would likely include minors and parents, according to the analyst note. Such data would be attractive for targeted phishing and social engineering aimed at pupils and parents. No field list, sample, or price is visible, so the real scope is unknown.
What to do
Change reused passwords on the Nomad Education account and warn families to be wary of unsolicited messages referencing the app. Monitor the case, as the sale remains neither confirmed nor denied by the company.
For the technical team
- Affected
- Nomad Education Base de dados de contas do Nomad Education, aplicativo popular de revisão escolar em francês que oferece cursos gratuito · Nomad Education, a French-language revision app offering free curriculum-aligned courses from primary school to higher education. About 4.8 million user accounts, according to the claim.
- Exploitation
- Sale listing on an underground forum, with no field list, sample, or price. Claim not independently verified, reported by DailyDarkWeb. Nomad Education has not confirmed an incident. The listing first appeared in mid-October and has recently resurfaced.
- Fix
- No fix applicable, as no vulnerability is confirmed.
- Vector
- Alleged database leak of about 4.8 million accounts offered for sale on an underground forum. Fields are not detailed and the compromise vector is unknown.
- More details
- The app serves school pupils, so a genuine dataset would likely include minors and parents, attractive for targeted phishing and social engineering. The underlying source is subscriber-only at DailyDarkWeb.
Timeline
Claim of a 4.8M-account dataset sale surfaced on an underground forum.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
