The Club Penguin Experience data breach: 6342 accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2024-10-26
In October 2024, The Club Penguin Experience (TCPE) suffered a data breach. The incident exposed over 6k subscribers' email addresses alongside usernames, age groups, passwords stored as bcrypt hashes and in some cases, plain text password hints. TCPE sent prompt disclosure notices to impacted customers following the breach. Exposed data: age groups, email addresses, password hints, passwords, usernames. The breach dates from Oct 14, 2024; Have I Been Pwned loaded it on Oct 26, 2024.
What to do
- If you had a The Club Penguin Experience account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch