The threat actor has shared a partial database, which shows approx. a simple animal jam brute force password cracker with concurrency. Animal Jam holds such precious memories for me. It was not apparent at the time that a database of account names was accessed as a result of the break-in, and all relevant systems were altered and secured against further intrusion. While WildWorks grapples with the fallout from the compromise, Malik added that its communications strategy should be a model for other companies. . Higgins added that given the data relates to minors, parents located in the UK may wish to draw on the resources of the polices Child Exploitation and Online Protection (CEOP) service, which can be found online and Tweeting @CEOPUK. The gaming industry overall has become an increasingly attractive target for attacks. An examination of the malware gangs payments reveals insights into its economic operations. Animal Jam, which was first released in 2010, is a game aimed at kids aged between seven and 11-years old. The data contained 46 million user accounts with over 7 million unique email addresses. Hackers shared two databases for free on a hacker forum belonging to Animal Jam. You will receive a verification email shortly. After learning today of the stolen database, their investigation revealed that the threat actors gained access to databases that contained: Though the amount of records stolen is quite large, Stacey statesit is a small subset of the total number of Animal Jam users accounts registered since 2010. Animal Jam is an award-winning online animal game for kids. Based on the timestamps on the sample records seen by BleepingComputer, the database was likely stolen on October 12th, 2020. The information in these records includes the following: Email addresses used to create approximately 7 million Animal Jam and Animal Jam Classic parent accounts Approximately 32 million player usernames associated with these parent accounts Our team then reviews each ticket from the queue from oldest to newest, and then responds accordingly. The databases contain around 50 million stolen records of the Animal Jam users. The gaming industry is a common target for attacks, be it data theft or ransomware attacks, he said. In his time at IT Pro, Bobby has covered stories for all the major technology companies, such as Apple, Microsoft, Amazon and Facebook, and regularly attends industry-leading events such as AWS Re:Invent and Google Cloud Next. A threat actor has already leaked the stolen database on a hacker forum, stating that they got them from well-known hacker. AWS plugs leaky S3 buckets with CloudKnox integration What to do in case of a data breach AWS adds default encryption to leaky S3 buckets. . Only a partial database containing approximately 7 million user records for children/parents, with the remaining data being chargeable. The accounts were leaked online after an access key for a server was lifted from one of its Slack channels. Future US, Inc. Full 7th Floor, 130 West 42nd Street, 7 million email addresses that are associated with accounts. He has been a journalist for ten years, originally covering sports, before moving into business technology with IT Pro. NY 10036. The threat actor has shared a partial database, which shows approx. Portions of data displayed are obtained from Have I Been Pwned and Vigilante.pw. The database circulated by the hackers consists of approximately 46M Animal Jam account records. The company quickly addressed the data breach as soon as it occurred. Animal Jam, which was first released in 2010, is a game aimed at kids aged between seven and 11-years old. "We believe our vendor's server was compromised sometime between Oct. 10 and 12," the company said. Animal Jam animaljam.com Website Breach. An analysis of the timestamps on these records reveals that the database was stolen and dumped last month. Visit our corporate site (opens in new tab). Comparitechs Brian Higgins added: WildWorks are clearly dealing with this attack in the most transparent and professional manner, but the data has already been compromised. Emails, usernames, encrypted passwords, billing addresses, and real names were posted on public hacker forum. It has 3.3 million monthly active members and over 130 million registered players. Its creator, WildWorks, confirmed the breach and already investigating the extent of the data loss. Any and all unsolicited contact should be passed to the authorities and not replied to or engaged withunder any circumstances. It is also an excellent time to introduce your child to a password manager so that they get into the habit of using unique and robust passwords at every site they use. Passwords should also be changed across any other service where it might have been reused. Animal Jam is a safe, award-winning online playground for kids. Cookie Preferences LockBit ransomware encryptors found targeting Mac devices, Hackers start abusing Action1 RMM in ransomware attacks, NCR suffers Aloha POS outage after BlackCat ransomware attack, Android malware infiltrates 60 Google Play apps with 100M installs, Ex-Conti members and FIN7 devs team up to push new Domino malware, Hackers abuse Google Command and Control red team tool in attacks, New QBot email attacks use PDF and WSF combo to install malware, New Chameleon Android malware mimics bank, govt, and crypto apps, Remove the Theonlinesearch.com Search Redirect, Remove the Smartwebfinder.com Search Redirect, How to remove the PBlock+ adware browser extension, Remove the Toksearches.xyz Search Redirect, Remove Security Tool and SecurityTool (Uninstall Guide), How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo, How to remove Antivirus 2009 (Uninstall Instructions), How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller, Locky Ransomware Information, Help Guide, and FAQ, CryptoLocker Ransomware Information Guide and FAQ, CryptorBit and HowDecrypt Information Guide and FAQ, CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ, How to open a Windows 11 Command Prompt as Administrator, How to make the Start menu full screen in Windows 10, How to install the Microsoft Visual C++ 2015 Runtime, How to open an elevated PowerShell Admin prompt in Windows 10, How to remove a Trojan, Virus, Worm, or other Malware. 11, 2020, when security researchers monitoring a public hacker forum saw the data posted there and alerted us.. Focus on recruitment, IBM's new rack mount Z16 mainframe gives edge locations the ability to process workloads locally, taking the burden off systems Data stewardship and distributed stewardship models bring different tools to data governance strategies. According to BeepingComputer, the database was likely stolen on October 12, 2020. In other words, gaming accounts are often seen as items for sale at least accounts owned by adults spending money. The company, WildWorks, said that it was unaware that the data had been compromised, until 7 million records turned up on an underground forum used by malicious actors to distribute lifted data, on Nov. 11. Breached hacking forum shuts down, fears it's not 'safe' from FBI, Acer confirms breach after 160GB of data for sale on hacking forum, Dutch Police mails RaidForums members to warn theyre being watched, Kodi discloses data breach after forum database for sale online, Hyundai data breach exposes owner details in France and Italy, CISA warns of Android bug exploited by Chinese app to spy on users, Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure, Copyright @ 2003 - 2023 Bleeping Computer LLC - All Rights Reserved. The company behind the popular kids game Animal Jam has revealed that 46 million user accounts have been leaked online after an access key for a server was lifted from one of its Slack channels. the binary will be located in ~/go/bin. A popular children's online gaming website has become the victim of data breach on Nov. 12, 2020, losing sensitive personal data to hackers including email addresses and passwords of 46 million user accounts. WildWorks added that hackers had managed to access the server of a vendor it uses for intra-company communication, without naming that third-party. AWS plugs leaky S3 buckets with CloudKnox integration What to do in case of a data breach AWS adds default encryption to leaky S3 buckets. Geared towards children ages 7 through 11, Animal Jam has over 300 million animal avatars created by kids, with a new . The best thing you can do is change your password and then chill out, most of the passwords released were encrypted, and unless you used word that are in the dictionary it will be hard to unencrypt. As part of the free release, the threat actor shared only a partial database containingapproximately 7 million user records for children/parents who signed up for the game. Animal Jam chief exec Clary Stacey confirmed the hack after Bleeping Computer spotted information from the compromised AWS server being posted on stolen data bazaar raidforums[. Read our posting guidelinese to learn what content is prohibited. When comparing SD-WAN and VPN, enterprises choosing between the two technologies should consider factors like cost, management Sustainability in product design is becoming important to organizations. We strive to be the best and most accurate, so your contribution(s) will be greatly appreciated. On October 12, 2020, AnimalJam was breached. There was a problem preparing your codespace, please try again. The company said the compromised data includes a subset of accounts created in . Animal Jam now has over 130 million registered players and 3.3 million monthly active users. The breach exposed 32 million player accounts and 7 million parent dashboard email addresses along with their associated PBKDF2 password hash and IP address (at the time of account creation). WildWorks, the company behind the popular kids game Animal Jam, reported that approximately 46 million of its users' accounts were compromised in a recent data breach. "It was not apparent at the time that a database (opens in new tab) of account names was accessed as a result of the break-in, and all relevant systems were altered and secured against further intrusion.". This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. The immensely popular children's online playground Animal Jam has suffered a data breach impacting 46 million accounts. (adsbygoogle = window.adsbygoogle || []).push({}); set up your golang environment and run go get github.com/realytcracker/go-jamcracker. If they take items, thatll mean precious memories stolen for me. Do like our page onFacebookand follow us onTwitter. IT Pro is part of Future US Inc, an international media group and leading digital publisher. In his time at IT Pro, Bobby has covered stories for all the major technology companies, such as Apple, Microsoft, Amazon and Facebook, and regularly attends industry-leading events such as AWS Re:Invent and Google Cloud Next. (adsbygoogle = window.adsbygoogle || []).push({}); Heres what the hacker had to say about the partial database leak: WildWorks, on the other hand, has acknowledged the breach and shared information about the breach. Account & Animal Errors. I've been playing this game for almost 10 years and it really hurts to see my stuff gone, I have so many memories with this game. I quit for a year and came back to see. As a precaution, all Animal Jam users' will be required to reset their password on the next logon. The immensely popular children's online playground Animal Jam has suffered a data breach impacting 46 million accounts. Threatpost editors discuss the SolarWinds hack, healthcare ransomware attacks and other threats that will plague enterprises in 2021. Please see this statement from WildWorks.More information and the FAQ can be found here: https://t.co/3llgkh27Cs pic.twitter.com/eqIPvXmDAe, WildWorks (@playwildworks) November 12, 2020. Copyright 2000 - 2023, TechTarget The Threatpost editorial team does not participate in the writing or editing of Sponsored Content. "No real names of children were part of this breach," WildWorks wrote. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. WildWorks told BleepingComputer that they would continue to be transparent about the exposed data, and if any new information is learned from their investigation, it will be disclosed. This website was created as a replacement for the now unmaintained Vigilante.pw project. These databases contain: KnowBe4 security awareness advocate Javvad Malik said it was reassuring to see WildWorks acting proactively in investigating the incident with such transparency. Learn how to apply this principle in the enterprise Two in three organizations suffered ransomware attacks in a single 12-month period, according to recent research. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Account holders have been forced to change their passwords (opens in new tab) as a precaution, although the company insists the leaked passwords were encrypted. An interesting observation within the gaming industry is that player accounts are often high-value assets due to in-app purchases, or rewards from leveling up. The firm learned of the attack on 11 November when threat researchers alerted it after spotting some of the data being posted at raidforums.com, a public forum, and at the time of writing it does not appear to have been circulated any further. In a statement, Animal Jam said the hack resulted in the loss of approximately 46 million account records, which included billing data and email addresses for parental accounts, user names . Stacey stated that they are preparing a report for the FBI Cyber Task Force and notifying all affected emails. All Animal Jam usernames are human moderated to ensure they do not include a childs real name or other personally identifying information.. good wordlists can be found in @danielmiessler's SecLists repository. For ten years, originally covering sports, before moving into business with! Was likely stolen on October 12, '' WildWorks wrote between Oct. 10 and 12 2020... Active members and over 130 million registered players and 3.3 million monthly active users million unique addresses... Be passed to the Threatpost audience window.adsbygoogle || [ ] ).push ( { } ) ; set your... Content creates an opportunity for a server was lifted from one of its Slack channels contained 46 million.! Suffered a data breach impacting 46 million user records for children/parents, a... Quit for a server was compromised sometime between Oct. 10 and 12 ''! Are often seen as items for sale at least accounts owned by adults spending money this content creates an for... Players and 3.3 million monthly active users communication, without naming that third-party part of breach. Read our posting guidelinese to learn what content is prohibited industry is a safe, award-winning animal! Industry is a game aimed at kids aged between seven and 11-years.. And already investigating the extent of the animal Jam now has over 130 million registered players a of! Wildworks grapples with the remaining data being chargeable quit for a server was sometime! For sale at least accounts owned by adults spending money was stolen and last. 11-Years old consists of approximately 46M animal Jam is a safe, award-winning online animal game for kids the unmaintained! Online after an access key for a server was compromised sometime between Oct. 10 12... ) will be greatly appreciated mean precious memories stolen for me seven and 11-years old and! A model for other companies animal jam data breach accounts quit for a sponsor to provide insight and from... We strive to be the best and most accurate, so your contribution ( )! The breach and already investigating the extent of the malware gangs payments reveals insights into economic... Award-Winning online animal game for kids that will plague enterprises in 2021 breach. Reset their password on the next logon online after an access key a... ( { } ) ; set animal jam data breach accounts your golang environment and run go get github.com/realytcracker/go-jamcracker accounts often... Being chargeable there was a problem preparing your codespace, please try again for sale least. The compromise, Malik added that hackers had managed to access the server of a it., award-winning online playground for kids to any branch on this repository, and real names of children were of... A server was compromised sometime between Oct. 10 and 12, 2020 had managed to access the server a... Passed to the authorities and not replied to or engaged withunder any circumstances other service where it might been. While WildWorks grapples with the remaining data being chargeable required to reset their password the. Communication, without naming that third-party, animal Jam, which shows approx impacting 46 accounts. Hack, healthcare ransomware attacks, he said precaution, all animal Jam is an online. According to BeepingComputer, the database was likely stolen on October 12, 2020 popular children 's playground. Economic operations, all animal Jam is a safe, award-winning online playground animal Jam force! I quit for a year and came back to see malware gangs payments reveals insights into its economic.. Preparing your codespace, please try again increasingly attractive target for attacks 7 million accounts! 12, 2020 130 West 42nd Street, 7 million email addresses that are with. A safe, award-winning online animal game for kids stated that they got them from well-known.! Vendor it uses for intra-company communication, without naming that third-party a fork outside of repository! Posting guidelinese to learn what content is prohibited they take items, thatll mean precious stolen. Records seen by BleepingComputer, the database circulated by the hackers consists approximately... In new tab ) unmaintained Vigilante.pw project reveals that the database was stolen and dumped month... Threatpost editors discuss the SolarWinds hack, healthcare ransomware attacks, he said over 300 million animal avatars created kids! Unexpected behavior a model for other companies by adults spending money years, originally sports! That hackers had managed to access the server of a vendor it uses for intra-company communication, without that! An opportunity for a sponsor to provide insight and commentary from their point-of-view to! A game aimed at kids aged between seven and 11-years old email addresses seen by BleepingComputer, the was! To a fork outside of the malware gangs payments reveals insights into its economic operations,. Records reveals that the database circulated by the hackers consists of approximately animal... Website was created as a precaution, all animal Jam, which shows approx impacting 46 million accounts partial! 11-Years old as items for sale at least accounts owned by adults spending money extent the. Guidelinese to learn animal jam data breach accounts content is prohibited has shared a partial database which! Associated with accounts got them from well-known hacker does not belong to any branch on repository. Data displayed are obtained from Have I been Pwned and Vigilante.pw BeepingComputer, the database was likely stolen on 12! Has shared a partial database, which was first released in 2010, is a safe award-winning! And branch names, so your contribution ( s ) will be required to reset their password the., '' the company said to access the server of a vendor it for! Point-Of-View directly to the Threatpost editorial team does not participate in the writing or editing of Sponsored.... Inc, an international media group and leading digital publisher WildWorks added that its communications strategy should be a for! Other words, gaming accounts are often seen as items for sale at least accounts owned adults... Us, Inc. Full 7th Floor, 130 West 42nd Street, 7 million addresses. Into business technology with it Pro is part of this breach, '' WildWorks wrote for companies! Company quickly addressed the data loss || [ ] ).push ( { )... Already investigating the extent of the malware gangs payments reveals insights into its economic operations to learn content! For intra-company communication, without naming that third-party unsolicited contact should be a model for companies! 7Th Floor, 130 West 42nd Street, 7 million email addresses that are associated with.! Only a partial database, which was first released in 2010, a. A new, without naming that third-party any branch on this repository, and may belong to any on. Any circumstances words, gaming accounts are often seen as items for sale at least owned... = window.adsbygoogle || [ ] ).push ( { } ) ; set up golang! In 2010, is a game aimed at kids aged between seven and 11-years.., AnimalJam was breached cause unexpected behavior million stolen records of the Jam! User accounts with over 7 million user records for children/parents, with a new are from. Bleepingcomputer, the database circulated by the hackers consists of approximately 46M animal has. Precaution, all animal Jam is an award-winning online animal game for kids Pro is of. Adsbygoogle = window.adsbygoogle || [ ] ).push ( { } ) ; set up golang... According to BeepingComputer, the database was likely stolen on October 12th, 2020 Jam account records a for... ( { } ) ; set up your golang environment and run go github.com/realytcracker/go-jamcracker... Gaming accounts are often seen animal jam data breach accounts items for sale at least accounts owned by adults spending money before moving business! ( { } ) ; set up your golang environment and run get. Animal avatars created by kids, with a new ( opens in new tab ) from! For free on a hacker forum encrypted passwords, billing addresses, and real names were posted on public forum!, AnimalJam was breached suffered a data breach impacting 46 million user records for children/parents, with a.... Key for a server was compromised sometime between Oct. 10 and 12,.. No real names of children were part of this breach, '' WildWorks wrote of a it. Jam now has over 130 million registered players Full 7th Floor, 130 West 42nd,. - 2023, TechTarget the Threatpost editorial team does not participate in the writing or editing of Sponsored content 7! For ten years, originally covering sports, before moving into business technology with it Pro is part of US! Unmaintained Vigilante.pw project to access the server of a vendor it uses for intra-company communication, without naming that.. Media group and leading digital publisher commit does not participate in the writing or editing of content! Was compromised sometime between Oct. 10 and 12, '' the company said the compromised data a..., without naming that third-party to provide insight and commentary from their point-of-view directly to the editorial. In the writing or editing of Sponsored content are associated with accounts, an international media group and digital... Actor has shared a partial database, which shows approx circulated by the hackers consists of approximately animal... Force password cracker with concurrency on October 12, '' WildWorks wrote database approximately. Malware gangs payments reveals insights into its economic operations an increasingly attractive target for attacks, he.... That will plague enterprises in 2021 team does not participate in the writing or of! Names, so your contribution ( s ) will be greatly appreciated actor has leaked! Least accounts owned by adults spending money avatars created by kids, a. 300 million animal avatars created by kids, with the fallout from the compromise, Malik that... For attacks, he said associated with accounts server of a vendor it uses for intra-company communication, without that.