Neopets neopets.com Neopets data breach: what happened and what to do
In May 2016 data from the virtual pet site Neopets was found being traded online. It covers about 26.9 million email addresses, with names, birthdates, genders, IP addresses and plain text passwords. The hack itself reportedly happened several years earlier.
View all 13,115 breaches- Breach date
- 5 May 2013
- Affected
- 26,892,897
- Data exposed
- Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Names, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In May 2016, a set of data from the virtual pet website Neopets turned up being traded online. According to Have I Been Pwned (HIBP), it was allegedly hacked "several years earlier", which is why HIBP dates the breach to May 2013. HIBP added 26,892,897 accounts to its index in July 2016.
Neopets is popular with children and teenagers, so many of the people in this data are now adults who haven't thought about their account in years. Older accounts often carry old email addresses and passwords that people reused elsewhere.
What was exposed
HIBP lists dates of birth, email addresses, genders, geographic locations, IP addresses, names, passwords and usernames. The passwords were stored in plain text, with no hashing at all, so anyone holding the data could read them directly.
That mix is useful to scammers. A name, birthdate and email address is enough to build a convincing phishing message, and a plain text password is the first thing an attacker tries on your other accounts. If you reuse passwords, one old gaming account can open a current email or shopping account.
What to do
Neopets is a different incident from any later security problems the site may have had. This page covers only the breach in HIBP's entry. Check whether your email appears there, change any password you used on Neopets and anywhere else, and use a unique password per site from now on.
What to do if you were in it
- 1
Change your Neopets password and any reuse of it
If you still have a Neopets account, set a new password. Then change it on every other account that shares the old one or a close variation. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app on your email, banking and shopping accounts. A leaked password then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Scammers use leaked email addresses to send fake security alerts. Don't click links in unexpected messages. Go to the site yourself instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your details. Serus monitors breach databases and the dark web and alerts you, but it can't remove data from a breach.
Frequently asked
Was I affected by the Neopets breach?
If you had a Neopets account before 2013, your email, name, birthdate and password may be in the data. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the Neopets breach?
HIBP lists dates of birth, email addresses, genders, geographic locations, IP addresses, names, passwords (in plain text) and usernames.
Should I change my password?
Yes. The passwords were stored in plain text, so change any password you used on Neopets and every site that shares it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
