789.vn Data Breach
The August 2021 789.vn data breach occurred when unauthorized threat actors exfiltrated the production user database of 789.vn (789.vn), a premier online testing, examination, and EdTech platform in Vietnam operating under the EQuest Education Group.
Exposed Data Types
6- Email addresses
- Passwords
- Names
- Phone numbers
- Dates of birth
- Social media profiles
About This Breach
The compromised data was subsequently distributed within breach intelligence circles.
What information was affected in the 789.vn incident?
The leaked relational database exports (users.txt, users_fb.txt, and users_site.txt) contain student and educator account profiles created both via direct registration and Facebook OAuth. The incident compromised records belonging to 250,065 unique verified users, exposing:
- Authentication Credentials: Passwords stored as MD5 hashes.
- Contact Details: Canonical email addresses and mobile telephone numbers.
- Personal Demographic Information: Full names, dates of birth, and gender indicators.
- Social & Account Metadata: Facebook account identifiers (UIDs) and OAuth registration logs.
How many accounts were affected?
Rigorous RFC canonical validation and deduplication confirmed 250,065 unique valid email addresses across more than 359,000 raw user entries.
Technical analysis and security risks
The usage of legacy MD5 hashing without modern key-stretching functions makes the password hashes highly susceptible to rapid GPU-accelerated cracking and rainbow table attacks. Coupled with full names, phone numbers, and Facebook profile linkages, the dataset poses elevated risks of credential stuffing, account takeover, and social engineering targeting students and educators.
Recommended actions for affected users
Individuals who registered on 789.vn should:
- Immediately change their password on any online service where the same or similar password was reused.
- Adopt a reputable password manager to maintain complex, unique credentials for each account.
- Enable multi-factor authentication (MFA / 2FA) on all critical email and social accounts.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
