BEIJING – If you think that an Ivy League email address could impress friends and colleagues but missed the boat on that prestigious paper diploma, a popular Chinese e-commerce site might be able to help out - for as little as 16 cents.
A report released by American network security company Palo Alto Networks found that email accounts from 42 universities around the world were available for sale on Taobao, the Chinese site which has drawn comparisons to eBay and Amazon. Harvard, Yale and Columbia are among the 19 universities on the list, the report said.
The accounts appeared to be stolen from current students, one of the authors of the report told NBC News. Claud Xiao said he discovered the illicit sale of the accounts on a Chinese software developer forum, adding in an email to NBC News that the anonymous online sellers he and his co-author, Rob Downs, chatted with on Taobao urged buyers to take steps to mask their usage of the email accounts.
“One of sellers suggested to us, ‘to take all necessary actions to avoid being found by the student’ including not changing the password and deleting newly sent or received mail,” Xiao wrote. “A student might notice their account receiving emails indicating the address had been used to sign up for new services.”
Prices ranged from 0.98 yuan ($0.16) to as much as 2,400 yuan ($390). For an added cost, buyers could apparently gain access to further information that would grant them the ability to change passwords and security questions. Some sellers even offered custom-named email addresses for just 27 yuan ($4.40). Beyond the prestige factor, some sellers also advertised the .EDU accounts as a way to access academic databases and take advantage of student discounts.
Xiao said it is not clear how the sellers gained access to the email accounts, but one answer could be that hackers gathered passwords from students’ other online accounts and tried their luck. He dismissed the idea that students may be selling their email addresses, saying it would be “very hard” for Chinese sellers to contact students from so many universities worldwide.
Palo Alto Networks said it had notified universities about the potential security breach, telling NBC News the universities had said they took the report - which was published last week - seriously. All but one of the nine schools contacted by NBC News this week declined to immediately comment on the report.
In an emailed statement, Erika Mantz, director of Media Relations for the University of New Hampshire wrote, “The University of New Hampshire is currently investigating the alleged sale of university email accounts in China. The cyber security of our faculty, staff and students is of the utmost importance and the university will take any necessary steps to remedy the situation.”
Taobao is owned by Alibaba Group, which is preparing to make its stock market debut soon. The company is planning to raise $24.3 billion the biggest U.S. initial public offering in history.
Florence Shih, a spokeswoman for the Alibaba Group said in a statement that the sale of “this type of product” is not allowed on Taobao and listings in question have been taken down.
“Any similar listings that are found on the platform will be removed and the sellers involved will be penalized,” she said.
While most of the sellers appear to have been scrubbed off the e-commerce site, a quick search by NBC News late Thursday revealed that other Ivy-League options still remain.
-- NBC News’ Xiwen Zhang contributed to this report.