iD Tech idtech.com iD Tech data breach: what happened and what to do
iD Tech, a tech camp service for kids, had a breach in January 2023. Data on 415,121 accounts was posted to a hacking forum: email addresses, names, dates of birth and plain text passwords. The company didn't confirm details.
View all 13,115 breaches- Breach date
- 3 Jan 2023
- Affected
- 415,121
- Data exposed
- Dates of birth, Email addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In February 2023, data from iD Tech, a company that runs tech camps for kids, was posted to a hacking forum. Have I Been Pwned says the data appears to have been breached the previous month, January 2023. The poster claimed almost 1 million records, but the data contained 415,121 unique email addresses.
The company didn't respond when HIBP tried to report the incident, and DataBreaches.net reported it was still silent weeks after the breach. HIBP added the data to its database in March 2023.
What was exposed
The data included:
- Email addresses
- Names
- Dates of birth
- Passwords, stored in plain text
Plain text means the passwords weren't scrambled at all, so anyone with the data can read them. That makes this worse than a typical password leak: if you used the same password anywhere else, someone can log in with it right away.
What it lets criminals do
A name, email and date of birth together can be used to write a convincing message to a parent or to the account holder, or to answer security questions on other accounts. Plain text passwords let attackers try the same email and password on other sites immediately.
If the account belonged to a child, the parent's email may be the one that leaked, so the phishing risk lands with the parent.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on iD Tech, then change it anywhere else you used the same one. Use a password manager so each account gets its own.
- 2
Turn on two-factor login
Two-factor login on your email and other important accounts stops someone who has an old password from getting in with it alone.
- 3
Expect phishing that mentions the breach
Messages may mention camps, courses or your child by name. Don't click links in unexpected emails or texts. Go to the site directly instead.
- 4
Be careful with dates of birth
A date of birth can't be changed. Don't use it as a password or security answer anywhere, and be wary of any call or message that asks you to confirm it.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks your email and phone number against known breaches and tells you which accounts to secure first. Serus monitors breach databases and the dark web and alerts you, but it can't remove data that has already leaked.
Frequently asked
Was I affected by the iD Tech data breach?
If you or your child had an iD Tech account, possibly. HIBP lists 415,121 unique email addresses. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the iD Tech breach?
Email addresses, names, dates of birth and plain text passwords, according to Have I Been Pwned.
Has iD Tech confirmed the breach?
HIBP says iD Tech did not respond to multiple attempts to report the incident. Press reports at the time described the company as silent on details.
Should I change my password?
Yes. Because the passwords were in plain text, change the iD Tech password and any other account that used the same one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
