46 million Animal Jam accounts leaked after comms software breach

Billing data, email addresses, user names, and encrypted passwords all leaked to the dark web

Tenth anniversary image of Animal Jam

The company behind the popular kids game Animal Jam has revealed that 46 million user accounts have been leaked online after an access key for a server was lifted from one of its Slack channels.

WildWorks, the parent company of Animal Jam, said it was made aware of the breach by alert database HaveIBeenPwned, which said user data had been shared on the dark web site Raidforums.

Animal Jam, which was first released in 2010, is a game aimed at kids aged between seven and 11-years old. It's marketed to parents as a free, safe, and educational virtual space where children can design animal avatars, learn about nature, and engage with others.

In a statement, Animal Jam said the hack resulted in the loss of approximately 46 million account records, which included billing data and email addresses for parental accounts, user names, encrypted passwords, and details for birthdays and player genders. The company stressed that no payment details had been accessed and that no real names had been leaked.

WildWorks added that hackers had managed to access the server of a vendor it uses for intra-company communication, without naming that third-party. Slack has since confirmed to IT Pro that it was the vendor in question, but stressed this was an isolated incident and that Slack's own infrastructure was not affected. It also said that password reuse was one likely cause of the breach.

"We believe our vendor's server was compromised sometime between Oct. 10 and 12," the company said. "It was not apparent at the time that a database of account names was accessed as a result of the break-in, and all relevant systems were altered and secured against further intrusion."

WildWorks said it was first made aware of the breach on 11 November and is now working with the FBI and international enforcement agencies.

Account holders have been forced to change their passwords as a precaution, although the company insists the leaked passwords were encrypted.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

How to use machine learning and AI in cyber security
Security

How to use machine learning and AI in cyber security

30 Jul 2021
Chipotle’s marketing email hacked to send phishing emails
phishing

Chipotle’s marketing email hacked to send phishing emails

29 Jul 2021
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

29 Jul 2021
Colonial Pipeline hack spurred copycat attacks on other oil and gas companies
hacking

Colonial Pipeline hack spurred copycat attacks on other oil and gas companies

29 Jul 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021