Leaked reused password for a few Khan Academy users

How it was found

I found A lot of credentials for your domain on the Telegram bot: ███ While the exact sources of the leaked data are unknown, the volume of exposed information is substantial. This report is submitted for your review to assess and mitigate the exposure of user credentials, including emails and passwords. Steps To Reproduce: 1-access this chatbot ===> ██████ 2-start the chatbot 3 - add www.khanacademy.org/login 4-u will get the passwords and emails just download them ███████ try (username or email : password) ██████ : ███ ████ : ██████ ███ : ████████

Impact

Impact Exposure of user emails and passwords, leading to credential compromise. Increased risk of account takeover (ATO) if users reuse passwords across platforms. Potential for phishing and social engineering attacks targeting affected users. Reputational damage due to leaked user data. Regulatory and compliance risks, depending on applicable data protection laws.