CloudPets cloudpets.com CloudPets data breach: what happened and what to do
In January 2017, the maker of CloudPets, internet-connected teddy bears that send voice messages, left its database publicly exposed. Data on over 821,000 records leaked, including emails, bcrypt password hashes, children's names and links to photos and recordings.
View all 13,115 breaches- Breach date
- Jan 2017
- Affected
- 583,503
- Data exposed
- Email addresses, Family members' names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
CloudPets makes teddy bears that record children's voices and send the messages to family and friends over the internet. In January 2017 the company left its database publicly exposed, and outside parties downloaded it. The data was also subject to 3 different ransom demands, according to Have I Been Pwned. Security researcher Troy Hunt wrote up the exposure after it came to light.
What was exposed
Have I Been Pwned received 583,000 records through a data trader, with email addresses and bcrypt password hashes. The full extent of data exposed by the system was over 821,000 records. It also included children's names and references to portrait photos and voice recordings.
What it lets criminals do
Parents' emails plus children's first names make a very believable phishing message. Bcrypt is a strong hashing method, but weak passwords can still be guessed, and anyone who recovers one can try it on other accounts. Because the voice messages and photos belong to children, the privacy concern goes beyond ordinary account takeover.
The company's response
Coverage at the time reported that CloudPets' parent company disputed how serious the exposure was. See Troy Hunt's write-up for the timeline.
What to do if you were in it
- 1
Change your password here and anywhere you reused it
Set a new password on CloudPets if you still have an account. Then change it on any other account that used the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or a hardware key on your email, banking and shopping accounts first, since those are what an attacker targets.
- 3
Stop using the old account and the toy's app
If you still own a CloudPets toy, think about whether you want to keep a cloud account tied to your child's voice and photos.
- 4
Expect phishing that uses your child's name
Be suspicious of any message that mentions your child's name together with an account or purchase problem.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone, and get alerts if new ones appear.
Frequently asked
Was I affected by the CloudPets breach?
Search your email address on Have I Been Pwned, or run a free Serus scan to check breach databases for your email.
What was exposed in the CloudPets breach?
Email addresses, bcrypt password hashes and children's names. The system also held references to portrait photos and voice recordings.
How many people were affected?
Have I Been Pwned holds 583,000 records. It says the full extent of data exposed by the system was over 821,000 records.
Should I change my password?
Yes, anywhere you used the same one. Use a unique password per site.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
