Children’s technology and toy firm Vtech has suspended trading on the Hong Kong stock exchange after admitting a hack that allegedly saw 4.8 million customer details stolen, including sensitive information about children and their parents.
A VTech spokesperson said an “unauthorised party” accessed VTech customer data housed on the company’s Learning Lodge app store database on 14 November.
VTech said that its customer data included private profile information, including names, addresses, IP addresses, email addresses, download history and secret questions and answers.
The company said that password information was also stolen, but that it was encrypted, and stressed that the data did not include credit card information.
The breach was confirmed by security analyst Troy Hunt, who verified a sample of the stolen data dumped on to the internet, which contained a wealth of customer information including the names, genders, birth dates and addresses of children.
Hunt found 4.8m unique customer email addresses indicating that 4.8m customer records were stolen, including over 227,000 children’s records, and said that the passwords were not encrypted as VTech claims.
Hunt said: “Once the passwords hit the database ... they’re protected with nothing more than a straight MD5 hash, which is so close to useless for anything but very strong passwords (which people rarely create), they may as well have not even bothered. The kids’ passwords are just plain text.
“The vast majority of these passwords would be cracked in next to no time; it’s about the next worst thing you do next to no cryptographic protection at all.”
This is the latest in a long line of data breaches that includes the recent TalkTalk hacks, which saw a database of millions of customers being accessed by hackers, leading to phishing attacks and scams.
But recently the privacy of children has been highlighted by alleged breaches of children’s connected toys, including the Wi-Fi connected Barbie doll, which security researchers claim can be hacked and turned into a surveillance device.
Hunt said: “Despite the frequency of these incidents, companies are just not getting the message; taking security seriously is something you need to do before a data breach, not something you say afterwards to placate people.”
Comments (…)
Sign in or create your Guardian account to join the discussion