The Digital Citizens Alliance reported that hackers and cyber criminals use .edu email addresses to buy and sell personal information associated with the account.

Some hackers use university email addresses to take advantage of college discounts (like Amazon Prime), but others can use them for phishing scams or to get access to the student or the college’s sensitive information.

The study examined email domains from the top 300 colleges and universities in the U.S. and found that in eight years, nearly 14 million email addresses and passwords were being distributed on the dark web. Interestingly, most stolen accounts were from large Midwestern schools, with the University of Michigan, Penn State, Minnesota, and Ohio State at the top of the list.

To read the full story by USA Today College, click here.