The personal information of about 5 million people – including the photos and profiles of more than 200,000 children – has been exposed following a hack of the electronic toy maker VTech.
Advertisement
The data accessed was on VTech’sLearning Lodge app store, which allows users to download learning games and other educational content. VTech’s website on Tuesday continued to say it had “temporarily suspended” the Learning Lodge site. Stolen adult data included name, mailing address, email address, password retrieval questions, IP address and passwords.
The company initially revealed the breach on Friday, but declined to disclose how many children’s profiles were affected.
The hacker claiming responsibility for the breach told Motherboard he or she had no plans to do anything with the data.
“When it’s hundreds of thousands of children including their names, genders and birthdates, that’s off the charts”, Hunt wrote on his blog regarding the VTech hack.
When Motherboard reached out to VTech for comment, the company’s spokesperson responded, “We were not aware of this unauthorized access until you alerted us”.
And things have taken another turn. While devices like kid-friendly smartwatches and tablets may block a child’s access to the bulk of the Internet, they’re still a potential target for hackers. VTechs legal department is handling those inquiries, though both sides are still in the early stages of communication, Corinna Chan, a spokeswoman for VTech, said by phone.
Hackers were able to pull childrens’ photos, chat logs and other personal data stored in VTech accounts, according to blogger Troy Hunt, who tracks data security breaches and said he was the first to notify VTech about the hack. “It was pretty easy to dump, so someone with darker motives could easily get it”, the hacker told Motherboard in an encrypted chat.
Advertisement
The hacker has, however, claimed that he doesn’t intend to sell or publish the data. To complete the payment or check-out process of any downloads made on the Learning Lodge website, its customers are directed to a secure, third party payment gateway.
