Education Giant Pearson Hacked, Exposing Customer Data

Pearson confirmed a cyberattack that exposed customer information and internal data, after attackers accessed its systems through an exposed developer token.

Pearson, one of the world’s largest education companies, confirmed it was hit by a cyberattack that exposed customer information and internal data, as first reported by BleepingComputer.

The UK-based giant, known for textbooks, digital tools, and exams in over 70 countries, admitted the breach to Bleeping Computer.

“We recently discovered that an unauthorized actor gained access to a portion of our systems,” a Pearson spokesperson said to Bleeping Computer. “Once we identified the activity, we took steps to stop it and investigate what happened and what data was affected with forensics experts.”

The company said the stolen information was mostly “legacy data” and did not include employee records. Pearson added, “We also supported law enforcement’s investigation” and have since strengthened their system security and monitoring tools, as reported by Bleeping Computer.

The breach reportedly started in January 2025 after hackers found a GitLab Personal Access Token (PAT) in a public file. This token, used by Pearson developers, gave attackers access to the company’s internal source code. That code included more passwords and tokens for cloud services.

Using these, the hackers reportedly stole terabytes of data from Pearson’s systems and cloud providers such as AWS, Google Cloud, Snowflake, and Salesforce. The stolen information allegedly includes customer details, financial data, help desk tickets, and more.

Bleeping Computer reports that Pearson declined to answer questions about whether they paid a ransom, the exact meaning of “legacy data,” how many people were affected, or if they planned to notify customers.

While Pearson has not confirmed how many users were impacted, the breach comes at a critical moment for education systems worldwide. Countries like the UAE, China, and the U.S. are rapidly integrating AI into school curriculums. The UAE, for example, plans to teach AI in all public schools starting in 2025.

This global shift raises the stakes for cybersecurity. AI systems used in education often handle vast amounts of personal and behavioral data.

If breached, these systems could expose not just student information but also the algorithms guiding how students learn, how teachers assess, and how decisions are made about academic performance.