VTech Data Breach Affects Five Million User Accounts

It’s been a year of hacks — from major retailers to Ashley Madison — but the latest impacts our most vulnerable: our children. A popular toymaker was hacked last week, exposing the personal information of millions of customers.

VTech Holdings, a Hong Kong-based company that makes electronic toys for kids, says hackers have obtained personal information of almost five million customers, including more than 200,000 children.

Motherboard, which first reported the hack, called it one of the largest known consumer data breaches. “The hacked data includes names, email addresses, passwords, and home addresses of 4,833,678 parents who have bought products sold by VTech,” Motherboard reported. The hack also included information on more than 200,000 kids including first names, genders, birthdays and in some cases photographs.

VTech announced the breach on its website Friday and posted a statement, which said in part:

An unauthorized party accessed VTech customer data housed on our Learning Lodge app store database on November 14, 2015 HKT. Learning Lodge allows our customers to download apps, learning games, e-books and other educational content to their VTech products.

Our customer database contains general user profile information including name, email address, encrypted password, secret question and answer for password retrieval, IP address, mailing address and download history.

The company noted that its customer database does not contain any credit card information or personal identification information such as social security number or driver’s license number.

VTech said it first learned of the breach on November 24, ten days after the hacker appeared to have gotten access. The company said it immediately began an investigation of the hack, which involved checking the affected site and implementing “measures to defend against any further attacks.”

However, Motherboard stated that VTech failed to alert customers of the severity of the breach. The hacker, who has been in contact with Motherboard, claimed that VTech left a lot of sensitive data exposed on its servers, including kids’ profile photos and chat logs between children and parents.

Agencies/Canadajournal