‘Byju’ User Details Leaked Online Due to Server Misconfiguration

Written by Bill Toulas
Published on June 30, 2021 has failed to properly secure one of its servers, irreversibly exposing the details of the users of one of its customers, Byju. The particular platform happens to be one of India’s largest and most valuable online education portals, which offers students of all ages access to educational videos that cover a wide range of topics. Byju reports having 4 crores (40 million) users in total and 30 lakh (3 million) paying subscribers. As such, the exposure is pretty serious and far-reaching.

The discovery of the unprotected server was the work of security researcher Anurag Sen, who found the instance on June 14, 2021. The man reached out to TechCrunch to get help in reporting the problem to the firm, and after some back and forth communication, the server was eventually pulled offline yesterday. As such, the total time of exposure was roughly two weeks, which is more than enough for malicious actors to have found it, accessed, and copied the data.

The details that have been exposed now include the following:

Upon realizing that the story was going public soon, the co-founder of has shared the following statement:

Our assessment suggests the exposed device appears to be a non-production, staging instance of one of our integration services having access to less than 1% of India-based end-of-life sales logs for a fortnight. follows stringent data security norms and is certified under the highest standards of global security and safety. We have, in an abundance of caution, immediately severed access to the cloud device.

That “immediately” though is just a word for “two weeks”, and also, keeping real user data on a non-production instance is a weird statement that has no believable explanation other than poor security practices and disrespect to people’s data privacy.

If you have an account on Byju, you should treat your personal details as compromised out of abundance of caution. Be aware of scamming and phishing attempts either via email or SMS or phone calls, and proceed with resetting your password on the platform as soon as possible.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: