Animal Jam animaljam.com Animal Jam data breach: what happened and what to do
In October 2020 attackers took data from Animal Jam, the children's game from WildWorks, and WildWorks disclosed it in November. Have I Been Pwned lists 7,104,998 accounts, with emails, names, dates of birth, addresses and passwords exposed.
View all 13,115 breaches- Breach date
- 12 Oct 2020
- Made public
- 12 Nov 2020
- Affected
- 7,104,998
- Data exposed
- Dates of birth, Email addresses, Genders, IP addresses, Names, Passwords, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Animal Jam is an online game for children made by WildWorks. In October 2020, attackers got into a server and took player data, which was then posted on a hacker forum. Have I Been Pwned (HIBP) gives a breach date of 12 October 2020, added the data on 12 November 2020, and counts 7,104,998 accounts.
What happened
WildWorks said a vendor's server was compromised between 10 and 12 October 2020. Reporting says the attackers got into an internal communication system and accessed a key that opened the user database. WildWorks learned of the theft on 11 November 2020, when security researchers monitoring a public hacker forum saw the data posted there.
WildWorks told players it was working with the FBI and international law enforcement, and pointed people to Have I Been Pwned to check whether their email was in the data.
What was exposed
HIBP lists dates of birth, email addresses, genders, IP addresses, names, passwords, physical addresses and usernames. Headline figures in the press were far larger than HIBP's, because they counted records in the full database, such as usernames. TechCrunch cited 32 million records with usernames, 23.9 million with gender and 5.7 million with a full date of birth. HIBP's count is the number of email accounts, 7,104,998, and this page uses it.
Some records included parents' full names and billing addresses, because parents set up accounts for their children. WildWorks said the passwords were encrypted and unreadable by normal means. Forum users claimed to have decrypted part of the data.
What that lets criminals do
For parents, the email address is most often a parent's address. It can now receive phishing that mentions Animal Jam or a child's account. A name with a billing address makes the message more believable.
For players who are now adults, a name, date of birth and address are the building blocks of identity theft, and children's identities are attractive because nobody checks their credit for years.
If a player reused their Animal Jam password, a criminal can try it elsewhere.
The company's response
WildWorks disclosed the breach within a day of learning of it, told players the passwords were encrypted, and said it was working with law enforcement.
If your child had an account
Change the password on the account and anywhere it was reused. Check the parent email on HIBP. Consider a credit freeze for your child, which most US credit bureaus allow parents to place.
How to check your own exposure
Search the email address used to register the account on Have I Been Pwned. For a child's account, that's usually a parent's address, so check yours. If the Animal Jam entry lists you, change the password on the account and on any other site where it was used. Then think about what else the data can connect: a child's name and date of birth, a parent's name and an address. Keep an eye on mail addressed to your child that you don't expect, such as pre-approved credit offers, because that can be a sign someone is using their details.
What to do if you were in it
- 1
Change your password and anywhere you reused it
Pick a new, unique password for the account, then change it on any other site where you used the same one. A password manager makes this quick. If a child reused their password on other games or apps, change those too. Turn on two-factor authentication where it's offered.
- 2
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that quote your name, phone number or the company. Don't click links in them. Go to the company's site yourself, or call the number printed on a card or a bill.
- 3
Consider a credit freeze for your child
Names, dates of birth and addresses can be used to open credit in a child's name. In the US, parents can ask Equifax, Experian and TransUnion to freeze a child's credit.
- 4
Talk to your child about messages that mention the game
Tell them that real game companies don't ask for passwords in chat or by email, and to come to you if a message seems odd.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the Animal Jam data breach?
Check the email address used for the account on Have I Been Pwned. HIBP lists 7,104,998 accounts. A Serus free scan checks your email and phone number against this and other breaches.
What was exposed in the Animal Jam breach?
Dates of birth, email addresses, genders, IP addresses, names, passwords, physical addresses and usernames, according to HIBP.
Why were there different numbers in the press?
Headlines counted records in the full database, such as 32 million usernames. HIBP counts email accounts: 7,104,998.
Should I change my password?
Yes. Change the Animal Jam password and anywhere it was reused, and turn on two-factor authentication where it's offered.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
