Toy Tablet Company Hacked; 5M Customer Records Leaked

Toy manufacturer VTech has been the victim of a hack that exposed details of five million customers. The compromised data included some details, albeit limited, of the children who use the products.

As its name suggests, VTech's product range includes many electronic toys that have increased in sophistication over the years. These include several tablet computers which don't allow web access, but do let children share messages with friends and family and download child-friendly apps through a system known as the "Learning Lodge."

No Financial Data Compromised

The company has now revealed that a hacker was able to access data from its database of Learning Lodge customer information. It says the compromised data included "user profile information including name, email address, password, secret question and answer for password retrieval, IP address, mailing address and download history. In addition, the database also stores kids information including name, genders and birthdates."

VTech stressed that the database doesn't include any personal identification data such as social security numbers. It also pointed out that all credit card transactions related to Learning Lodge are handled by a third party and thus aren't in the database.

As a precautionary measure, VTech has contacted all customers and temporarily suspended both the Learning Lodge website and the service itself, a suspension that was still in force at the time of writing. The breach was considered so serious that trading in the company's stock was briefly suspended before being reinstated.

Kids' Home Addresses Could Be Found

Security specialist Troy Hunt has noted that although the information VTech had on children was extremely limited, it's made much more serious by being stored in a database alongside the details of parents.

As the database was publicly leaked by the hackers, Hunt was able to analyze it and, by checking with some of the customers, confirm the leaked data was genuine. He found that not only were the passwords stored with the absolute minimum level of encryption, but the security questions and answers on accounts were stored as plain text.

The way the data was set up means its possible to not only identify a specific child through first name, age and gender, but then to use the matching parent's account data to discover the child's surname and physical address. (Source: troyhunt.com)

One online rights group has reported the breach to the Federal Trade Commission, calling for an investigation into whether VTech has broken the Children's Online Privacy Protection Act, a law which lays down enhanced privacy rules for children aged 11 and younger. (Source: washingtonpost.com)

What's Your Opinion?

Do you have kids or other child relatives who use VTech's Learning Lodge? Are you concerned about the way companies handle data about children? Should firms take additional measures to prevent both direct and indirect identification of specific children by hackers?