Toymaker VTech will be investigated by several US states after a hack that exposed the private data of 6.4 million children, including photos and addresses.
Attorneys general of Connecticut and Illinois said they will investigate the breach, the largest known hack targeting children, which exposed the private data of more children than the 4.9 million adults caught in the hack.
The attack on the Hong Kong-based company’s portal used to download games to its computer tablets saw the hackers steal photos and chat logs along with a customer database.
The personal information stolen, which was not encrypted, included names, email addresses, passwords, secret questions and answers for password retrieval, IP addresses, postal addresses, download histories and children’s names, genders and birth dates, according to VTech.
A spokeswoman for Connecticut’s attorney general said: “The disclosure of the scope of the breach is troubling.”
The Hong Kong Privacy Commissioner Stephen Wong said his office had initiated a “compliance check” on VTech to see if the company had followed data privacy principles. Security experts said they expected the size of the breach would prompt governments to scrutinise VTech and other toymakers to review their security.
Tod Beardsley, security research manager with Rapid7 Inc, said: “VTech is a toymaker and I don’t expect them to be security superstars. They are amateurs in the field of security.”
Seth Chromick, a threat analyst with network security firm vArmour said: “This breach is a parent’s nightmare of epic proportions. A different approach to security for all organisations is needed.”
Chris Wysopal, co-founder of cybersecurity firm Veracode, said it could be a wake up call for families in the same way that the hack on infidelity website Ashley Madison exposed cheaters.
Stolen records such as credit card details and personal information are available online for around £1 each, while records and photos of minors could be worth considerably more on the darkweb, experts say.
