I was recently sent a notification by https://haveibeenpwned.com/ that one of my email addresses has been found in a breach, in particular in a breach of https://www.chegg.com. I am positive I never signed up for an account there, it's a US education company and I am not from there, nor did I ever have anything to do with US education.

I have verified the email is actually from haveibeenpwned.

I figured it's possible they merged with another company and took over their user base, but I can find no evidence of that.

If I try to sign in to chegg.com I do get a notification that I should reset my password for logging in. I did this and got a reset password email, what makes it even more dodgy is that I am adressed as Hi , to reset your password... so obviously they left out the name I should be addressed by after Hi.

I actually logged in with the new random password and it seems my account did have a free ebook purchase there, but it's definitely not a book that I ever was interested in. I suppose the likely scenario is that chegg never did email validation and someone just used my email address? Are there any other options? I also don't remember getting any signup emails which is common for services even if they don't verify email addresses.


The main thing for this is because databases that got compromised did contain information that came from other websites you were registered on.

  • Possible, although it doesn’t match with me having a purchase there of a book that I never obtained, free or not. – Sebastiaan van den Broek Aug 16 '19 at 8:44
  • It could be just a "test purchase" to make their user data more trustworthy and reliable. – tungsten Aug 16 '19 at 8:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.