Neopets Is Still A Thing And Its Exposing Sensitive Data

guest · Dec 28, 2020

Neopets Is Still A Thing And Its Exposing Sensitive Data
December 28, 2020
https://securityledger.com/2020/12/neopets-is-still-a-thing-and-its-exposing-sensitive-data/

Neopets, a website that allows children to care for “virtual pets,” has exposed a wide range of sensitive data online including credentials needed to access company databases, employee emails, and even repositories containing the proprietary code for the site, according to information shared with The Security Ledger.

The data includes the IP addresses of Neopets visitors, information that could be used to target Neopets users, according to independent researcher John Jackson, who said he discovered the information after scanning the company’s website with a security tool.
Click to expand...

In an email to The Security Ledger, Jackson said that he noticed Neopets accounts being offered for sale on an online forum. That prompted him to run a scan on the Neopets site using a forensics tool. That scan revealed a Neopets subdomain that exposed the guts of the Neopets website, Jackson said via instant message.

“We looked through and found employee emails, database credentials and their whole codebase,” he said.
Click to expand...

guest · Jul 20, 2022

Neopets data breach exposes personal data of 69 million members
July 20, 2022

Virtual pet website Neopets has suffered a data breach leading to the theft of source code and a database containing the personal information of over 69 million members.

Neopets is a popular website where members can own, raise, and play games with their virtual pets. Neopets recently launched NFTs that will be used as part of an online Metaverse game.
On Tuesday, a hacker known as 'TarTarX' began selling the source code and database for the Neopets.com website for four bitcoins, worth approximately $94,000 at today's prices..
Click to expand...

In a conversation with BleepingComputer, TarTarX says that they stole the database and approximately 460MB (compressed) of source code for the neopets.com website.

The seller claims that this database contains the account information of over 69 million members, including members' usernames, names, email addresses, zip code, date of birth, gender, country, an initial registration email, and other site/game-related information.
Click to expand...

However, pompompurin, the owner of the Breached.co hacking forum, verified the hacker's claims by registering an account on Neopets.com and being sent their newly created record from the database.

"Vouch, I registered an account on the website and he sent the full entry," pompompurin posted to the Breached.co forums.
Breach is confirmed
After the news of the breach spread online, the Neopets team, designated by the TNT abbreviation, has confirmed on Discord that they are aware of the security incident and working on resolving it.
Click to expand...

This is not the first data breach for Neopets, with member data previously circulating online in 2016 from a breach that occured in 2012.
Click to expand...

guest · Jul 22, 2022

Mixed Messages as Neopets Scrambles to Respond to Mega Breach
July 22, 2022

Tens of millions of users of a popular virtual pet site may have had their data compromised in the first known US mega breach of 2022.

Neopets, which is owned by US giant Viacom, took to Twitter yesterday to confirm the news.

“Neopets recently became aware that customer data may have been stolen. We immediately launched an investigation assisted by a leading forensics firm. We are also engaging law enforcement and enhancing the protections for our systems and our user data,” it said.
“It appears that email addresses and passwords used to access Neopets accounts may have been affected. We strongly recommend that you change your Neopets password. If you use the same password on other websites, we recommend that you also change those passwords.”
Click to expand...

However, moderators on the Neopets Discord channel warned that hackers still had access to Neopets systems, so changing passwords now would not work.

“We should note that the effectiveness of changing your Neopets password is currently debatable,” they said. “As long as hackers have live access to the database, they can simply check what your new password is. We cannot therefore strictly advise you on the best course of action given the circumstances.”
Click to expand...

However, Rebecca Moody, head of data research at Comparitech, confirmed that if the figures are correct, it appears to be the biggest US breach of 2022 so far and the only one over 10 million customers.

“What's perhaps more concerning is the potential age range of the users affected with the website being popular among children and teens as well as adults,” she added.
Click to expand...

guest · Sep 3, 2022

Neopets says hackers had access to its systems for 18 months
By Bill Toulas @billtoulas - September 1, 2022

Neopets has released details about the recently disclosed data breach incident that exposed personal information of more than 69 million members.

Findings of the investigation launched on July 20, 2022 revealed that attackers had access to the Neopets IT systems from January 3, 2021 until July 19, 2022.
Click to expand...

The company learned about the breach only after a hacker offered to sell a Neopets database for four bitcoins.

The hacker claimed the database contained 460MB of source code and sensitive personal information for 69 million members.
An update from the company on Monday confirmed the hacker's claims, saying:

"We have determined that for past and present Neopets players, affected information may include the data provided when registering for or playing Neopets, including name, email address, username, date of birth, gender, IP address, Neopets PIN, hashed password, as well as data about a player's pet, game play, and other information provided to Neopets."
"For players that played prior to 2015, the information also could have included non-hashed, but inactive, passwords," the company added.
Click to expand...

Passwords have now been reset and Neopets is now working on implementing multi-factor authentication as an added defense layer.
Finally, the announcement recommends that all Neopets players change their passwords if they're recycling them for other online platforms or services.
Click to expand...

Log in or Sign up

Neopets Is Still A Thing And Its Exposing Sensitive Data

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Neopets Is Still A Thing And Its Exposing Sensitive Data

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches