Animal Jam kids' virtual world hit by data breach, impacts 46 million accounts

guest · Nov 11, 2020

Animal Jam kids' virtual world hit by data breach, impacts 46M accounts
November 11, 2020
https://www.bleepingcomputer.com/ne...orld-hit-by-data-breach-impacts-46m-accounts/

The immensely popular children's online playground Animal Jam has suffered a data breach impacting 46 million accounts.

Animal Jam is a virtual world created by WildWorks, where kids can play online games with other members. Geared towards children ages 7 through 11, Animal Jam has over 300 million animal avatars created by kids, with a new player registering every 1.4 seconds.

Yesterday, a threat actor shared two databases belonging to Animal Jam for free on a hacker forum that they stated were obtained by ShinyHunters, a well-known website hacker.
Click to expand...

As part of the free release, the threat actor shared only a partial database containing approximately 7 million user records for children/parents who signed up for the game.
Full transparency from WildWorks
In what should be considered a model on transparent reporting of a data breach, WildWorks shared with BleepingComputer that they learned of the breach this morning and have been actively investigating it.

WildWorks CEO Clary Stacey told BleepingComputer that he believes the threat actors obtained WildWork's AWS key after compromising the company's Slack server. When the breach occurred, it was quickly addressed, but they were unaware that any data was stolen at the time.

"WildWorks is a small company, but we take player security very seriously. We are deeply concerned to learn of this breach, albeit relieved that no sensitive information such as plaintext passwords or real names of children were exposed in this theft. " Stacey shared with BleepingComputer.
Click to expand...

guest · Nov 12, 2020

Data has been added to Have I Been Pwned:

Animal Jam - 7,104,998 breached accounts

Animal Jam
In October 2020, the online game for kids Animal Jam suffered a data breach which was subsequently shared through online hacking communities the following month. The data contained 46 million user accounts with over 7 million unique email addresses. Impacted data also included usernames, IP addresses and for some records, dates of birth (sometimes in partial form), physical addresses, parent names and passwords stored as PBKDF2 hashes.

Breach date: 12 October 2020
Date added to HIBP: 12 November 2020
Compromised accounts: 7,104,998
Compromised data: Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Physical addresses, Usernames
Permalink
Click to expand...

mood said: ↑

Animal Jam kids' virtual world hit by data breach, impacts 46M accounts November 11, 2020
Click to expand...

Updated:

Update 11/11/20 10:30 PM EST: Added info about newly released FAQ site.
Click to expand...

guest · Dec 9, 2020

Animal Jam data breach: 100,000 de-hashed user records leaked, 900,000 more sold on hacker forum
December 9, 2020
https://cybernews.com/security/anim...ords-leaked-900000-more-sold-on-hacker-forum/

A database containing 900,000 user records from the free-to-play game Animal Jam is being sold on hacker forums, with another 100,000 records leaked as a proof-of-concept sample.

Recently, the game suffered a data breach where a database containing more than 50 million stolen player records, including email addresses and hashed passwords, has been leaked on a hacker forum.
It seems that it took about a week for a second hacker to de-hash about a million passwords from the previous database and put the plain-text data for sale on another hacker forum: the user records stored in the file that was posted on the hacker forum on November 17 include the players’ email addresses and passwords in plain text.
What’s the impact of the leak?
Fortunately, the data found in the leaked file does not contain deeply sensitive information like document scans or credit card numbers.
Click to expand...

De-hashing: The danger of using weak passwords
Competent threat actors are able to de-hash weak passwords by taking acquired lists of password hashes and comparing them with hashes of known weak hash combinations.
This might be how the threat actor who is selling the Animal Jam combo-list acquired a million passwords in a relatively short amount of time since the Animal Jam data breach.
Click to expand...

Log in or Sign up

Animal Jam kids' virtual world hit by data breach, impacts 46 million accounts

guest Guest

guest Guest

guest Guest

Log in or Sign up

Animal Jam kids' virtual world hit by data breach, impacts 46 million accounts

guest Guest

guest Guest

guest Guest

Useful Searches