Millions of University Email Addresses Found For Sale on the Dark Web

You know that .edu email address you have or had at one time? It may have gotten you some good discounts on various products, such as software. And you probably think that it’s really not all that valuable. After all, it’s just an email address, right? Turns out, it is actually quite wrong.

Researchers have found millions of stolen email addresses from universities throughout the U.S. They are offered for sale anywhere from $3.50 to $10 each and they come from some of the largest and most well known universities in the nation, including the University of Michigan (which “boasts” the highest number), Penn State, Ohio State, and MIT.

The research firm ID Agent found credentials on the dark web from those schools and another 296 large institutions. A significant spike in the number of these .edu addresses is being seen in 2017 by researchers. In 2015, they saw around 2.2 million. In 2016, 2.8 million, but now they are seeing nearly 14 million of them. It’s thought that they are being acquired from third-party sites that suffered a breach such as social media and e-commerce sites where the users registered with their university email addresses.

It is speculated that these could also have come from large breaches at companies such as Yahoo, which reported incidents in prior years that affected billions of people. LinkedIn was another notably large breach affecting millions.

It’s unconfirmed if the passwords that go with the logins are valid and undoubtedly, some of the email addresses are likely spoofed. However, that is still a problem for universities as spoofed email addresses are often used to send spam that frequently contains malware.

Whomever buys these credentials can use them to get those same discounts you may have gotten with your university email address, as well as deep discounts off Amazon Prime memberships (which may be a 50% discount off the regular price), discounts to entertainment, or access to university resources. It may not seem like a big deal, but the ramifications can go further. It is difficult to quantify the damage to reputation and lost business because of some nefarious action related to a domain email address.

The solution? Well, there really isn’t a guaranteed way to keep any email address from being stolen or used for spam or spreading malware. The best way to avoid it is to teach young people and everyone about Internet risks. This includes identifying phishing attempts, when it is OK or not to open a link or attachment received in email, how to create strong passwords, and how to be a responsible Internet consumer.

This is certainly not the first time those in an educational institution were targeted. In 2016, students, faculty, and staff at the University of Central Florida and at Brown University were victims. In 2015, the University of Michigan was the victim of an incident where the pranksters posted inappropriate content to the school’s Facebook page. Experts are postulating that along with government, healthcare, and small businesses, educational institutions are becoming more frequently targeted by cybercriminals than ever before.