DataCamp found that a third party had illegally acquired access to one of their systems and disclosed some user data there. The company sent emails to the users they believed were impacted or could be impacted. Any DataCamp users who might have been impacted were signed out, and if they used passwords for authentication, their credentials were invalidated and they were instructed to change them. The exposed information includes personal information such as name, email address, optional information including location, company, biography, education, picture, and some account information like Hashed passwords using bcrypt, Creation date, Last sign-in date, Sign in IP address. The company does not store credit card data and thus does not believe credit card or Paypal data were affected. They investigated the incident and took preventive steps type to stop such incidents in the future.