A hacker claims to have stolen data from Neopets, the long-running virtual pet web site, affecting 69 million customers of the service.
The hack was confirmed by posts from the official Neopets Twitter and Instagram accounts on July twentieth, with a tweet informing the public that the firm “recently became aware that customer data may have been stolen” and had employed a forensic agency to research. The social media posts didn’t give additional details about the scope of the hack however steered that every one web site customers change their passwords as a precaution.
Neopets just lately grew to become conscious that buyer knowledge might have been stolen. We instantly launched an investigation assisted by a number one forensics agency. We are additionally partaking regulation enforcement and enhancing the protections for our programs and our consumer knowledge. (1/3)
— neopets (@Neopets) July 21, 2022
According to particulars reported by BleepingComputer, a hacker named TarTarX started to supply knowledge on the market on a hacking discussion board on Tuesday. The hacker was reportedly soliciting a worth of 4 Bitcoins for the knowledge, equal to roughly $90,500.
Details of a database schema shared by the hacker counsel that the stolen knowledge consists of not solely usernames, emails and passwords but in addition customers’ date of beginning, zip code, gender, and nation — compounding the likelihood that it could possibly be used to phish or in any other case defraud customers in the unsuitable arms.
The discussion board publish made by the hacker additionally claims that they proceed to have the ability to entry the stay model of the Neopets web site database — a truth BleepingComputer studies as being confirmed by the proprietor of the hacking discussion board the place the knowledge was posted. If true, this means that even the precautionary measures suggested by Neopets could be inadequate to guard a consumer’s account from unauthorized entry.
First launched in 1999, the Neopets web site has suffered from various safety lapses in recent times, significantly after possession modified arms from Viacom to JumpStart Games in 2014. In 2016, the same knowledge breach led to probably tens of tens of millions of customers’ particulars being stolen and traded on hacking boards. And in 2020, safety researchers found entry to the web site’s total codebase being offered on account of administrator credentials that had been written straight into sections of code found by hackers.
More just lately, the Neopets franchise has occasion regarded to pivot into the metaverse, turning its beloved characters right into a line of NFTs. But the transfer was broadly panned by followers, with the operators of certainly one of the hottest fan websites describing it as a “cash grab.”
A request for remark despatched to Neopets had not been answered by time of publication.
