Illustrative exampleEducation / eLearning

A course platform that found the credential stuffing in its logs, not its chargebacks

Stolen passwords were being tried against forty thousand student accounts and turned into gift purchases. A managed SIEM and a SOC watching it now catch the pattern within minutes.

This shows the kind of work we do. It is not a client engagement, and the business in it is invented.

Where it started

The problem

Forty thousand students, most paying monthly, and a login page that let anyone try passwords as fast as they liked.

Nobody noticed the attack itself. What they noticed was a run of chargebacks from students whose accounts had bought course bundles as gifts, sent to addresses nobody recognised.

What changed

What we did

We fed the login logs and payment events into a managed SIEM and wrote detections for what had actually happened: thousands of failed logins from one network block, or a successful login followed by a gift purchase inside five minutes.

Our SOC watches those alerts around the clock. When one fires, the account locks and the purchase is held until the student resets their password from an email we send.

Then we fixed the door. The login page got rate limiting and bot checks, and every student was offered a passkey. About one in five took it in the first month.

The platform is run from Lisbon, seven hours ahead of us, which suits round-the-clock monitoring well. Their night is our working day.

Built with

  • Microsoft Sentinel
  • Cloudflare
  • Stripe Radar
  • WebAuthn
  • Laravel

Services in this job

More on elearning

Got a job like this one?

Tell us what's slow, fragile or stuck.

We'll tell you whether it's work we should be doing and what it would involve. Every quote is written for the job in front of us.

Talk to usMore work
  • What we arePlan, create, launch, maintain
  • What we areSentrello Premier Partner
  • What we areEvery quote written for you