CloudPets data breach: 583K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2017-02-27
In January, the maker of teddy bears that record children's voices and sends them to family and friends via the internet CloudPets left their database publicly exposed and it was subsequently downloaded by external parties (the data was also subject to 3 different ransom demands). 583k records were provided to HIBP via a data trader and included email addresses and bcrypt hashes, but the full extent of user data exposed by the system was over 821k records and also included children's names and references to portrait photos and voice recordings. Exposed data: email addresses, family members' names, passwords. The breach dates from Jan 1, 2017; Have I Been Pwned loaded it on Feb 27, 2017.
What to do
- If you had a CloudPets account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
