Club Penguin Rewritten (January 2018) data breach: 1.7M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2019-04-23
In January 2018, the children's gaming site Club Penguin Rewritten (CPRewritten) suffered a data breach (note: CPRewritten is an independent recreation of Disney's Club Penguin game). The incident exposed almost 1.7 million unique email addresses alongside IP addresses, usernames and passwords stored as bcrypt hashes. When contacted, CPRewritten advised they were aware of the breach and had "contacted affected users". Exposed data: email addresses, ip addresses, passwords, usernames. The breach dates from Jan 21, 2018; Have I Been Pwned loaded it on Apr 23, 2019.
What to do
- If you had a Club Penguin Rewritten (January 2018) account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
