Jerry on PieFed

I see your post here on a PieFed instance, so it apparently is federating.

Received this email about Udemy having been hacked. Doesn’t seem like Udemy feels any urgency in informing anyone.

Hi Jerry, an announcement has been made from Alexander, instructor of Elementor Mastery - Build Amazing Websites With Elementor, The Ultimate WordPress Boot Camp Course - Build 10 Websites and 1 more course.

Hi everyone,

I wanted to reach out directly about a security incident that affects this platform and may affect you.

On April 24, the threat group known as ShinyHunters added Udemy to their data leak site and issued a three-day deadline. The deadline passed on April 27, and the data has now been published. Have I Been Pwned has confirmed the leak contains approximately 1.4 million unique email addresses, along with names, physical addresses, phone numbers, employer information, and for instructors, payout method details (PayPal, cheque, bank transfer information).

As of this announcement, Udemy has not issued a public statement, has not responded to media inquiries, and has not directly notified affected users. I want to be transparent with you that this is the case, because you may not learn about it from Udemy itself.

What you should do right now:

1. Check your email address at haveibeenpwned.com to confirm whether your account is in the leaked dataset.

2. Change your Udemy password immediately, and change it anywhere else you may have reused that password.

3. Enable multi-factor authentication on your Udemy account if you have not already.

4. Be alert for targeted phishing emails over the coming weeks. Attackers will likely send messages referencing your course history, instructor name, or payout details to appear legitimate. Treat any unexpected email about your account, refunds, or payments with extra scrutiny.

5. If you are an instructor, monitor your linked payout accounts (PayPal, bank) closely for unusual activity.

I have published a video on my YouTube channel that walks through the breach in detail, explains how this attack pattern works, and covers each of these protective steps in depth. If you find this kind of breakdown useful, the link is below.

https://www.youtube.com/watch?v=Ycbeoibawp8

I will continue to update you here if Udemy issues a statement or if new information emerges. In the meantime, take the steps above and stay vigilant.

Stay safe,

Alex

My understanding is that while the older Pixel phones had MTE capability, it was off by default and could only be enabled under the dev settings. Google did not enable it by default because Android depends heavily on vendor board support packages, proprietary SOC drivers, and HAL modules. Google felt that driver code quality from 3rd-parties is not clean enough to enable kernel-level MTE without risking bootloops and spontaneous reboots. Even worse for C++ apps, which often read slightly past their allocated memory blocks. Instead, Google rewrote critical core Android system daemons using Rust. Like the keystore, Bluetooth stack, DNS resolver, and others. I believe using Rust essentially makes MTE unnecessary. Also full synchronous MTE mode has high CPU/memory bus penalties (could be 5-10% under heavy memory loads). Google probably decided that since hardly anyone used MTE anyway on earlier Pixel devices, they could use the space in the chip for other uses. The point is that the post makes it sound like using a Pixel 11 under Android results in less security than before, but for most people there is no change since they never used MTE anyway.