Education technology company Chegg Inc. has been hacked for the third time since 2018 with employee data stolen.

The latest hack involved the theft of some 700 employee records and included names and Social Security numbers, according to a report in TechCrunch. How the hack took place was not shared, but Chegg said it had hired a forensic firm and informed law enforcement of the breach.

The new hacking came a day after a federal judge ruled that a lawsuit against the company for its 2018 hack be sent to arbitration. That hack, disclosed in September 2018 and dated to April the same year, involved the theft of data belonging to 40 million users. Thinkful, a company owned by Chegg, was also hacked in September 2019.

“Far too often the disclosure of a significant breach is in the news. Unfortunately, Chegg has made headlines again for a data breach,” James Carder, chief security officer and vice president, at security intelligence company LogRhythm Inc., told SiliconANGLE. “Organizations must take a proactive approach to protecting data. This should include mapping organizational capabilities and security controls to measure their preparedness to detect, prevent and respond to threats.”

Carder noted that the incident is similar to Chegg’s previous incidents, since an unauthorized party gained access to sensitive information. “This time around hackers stole employee records including Social Security numbers, which can be detrimental to the victims as it can never be changed and may lead to further fraud,” he said.

Scott Gordon, chief information system security professional at secure access provider Pulse Secure LLC, said the attack is another sign of the serious threats facing education during the COVID-19 pandemic.

“The education sector is particularly vulnerable during social distancing since they need to adjust operations for over 25 million students across 4,235 higher education institutions in the United States that have been impacted by COVID-19,” Gordon said. “Security controls across the edtech supply chain need to adapt to an expanded attack surface as institutions will extend e-learning scope options and be targeted.”

Image: Chegg