The WildWorks company has recognized a massive theft in the world-famous kid gaming service that is Animal Jam. The cybercriminal has stolen 46 million records of data from the gaming service and later published all the data on the official website of the Dark web.
At first, the company was unaware that the data had been negotiated until 7 million records rolled up on a hidden forum that has been used by all kinds of ill-disposed threat actors to divide the lifted data.
Animal Jam is one of the very famous gaming services for children; it has over 300 million animal avatars that have been created by kids, with an all-new player registering every 1.4 seconds.
According to the report the stolen user account credentials were collected in a database inside the vendor-owned server, and there is also a subset of the records that included the email addresses of the parents controlling the player accounts and additional data that could be utilized to recognize the parents of Animal Jam players.
Data stolen
The credentials that are stolen in this attack are mentioned below:-
- The email addresses are used to generate approximately 7 million Animal Jam accounts.
- Nearly 32 million player usernames connected with these parent accounts
- All the passwords were linked with those user accounts but in encrypted form.
- Nearly 14.8M records carry the birth year the player registered at account creation.
- 23.9M records cover the gender the player entered at account origination.
- 5.7M accounts involve the full birthday the player listed at account registration.
- 12,653 of the parent accounts include a parent’s full name and billing address.
- 16,131 of the parent accounts include a parent’s first and last name, outwardly a billing address.
Where this stolen data circulated?
After investigating the whole matter, the security researchers have found that all the above data were circulated on raidforums.com, it is a very well-known online forum for all kinds of cyber-criminals.
However, the security researchers are still investigating the whole matter so that they find some more additional information regarding this attack.
When and how this incident happened?
The vendor’s servers were compromised in 2020, between October 10-12, while the security researchers were not confirmed regarding the compromised data, and they confirmed the data breach on November 11, 2020.
The security researchers have stated that the threat actors are able to penetrate the server of third-party vendor WildWorks; but, the hackers obtained a key that helps them to get access to all the databases.
Mitigation
Apart from this, the security experts have mentioned some mitigation that will help the vendors to bypass this kind of threat attack, and here they are mentioned below:-
- Never share the animal password with anyone.
- In case if your email address was included in the breach, then immediately change your email account password.
- If any user believes that their Animal Jam account has been used illegally, then they can directly contact the security team for further information and guide.
The whole matter is being investigated by the FBI, and the company is sharing all the information with the FBI and international enforcement agencies. Moreover, the company said that they would work equally along with law enforcement so that they will easily know all the details regarding this threat attack and threat actors behind this attack.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Also Read:
Authorities Arrested 179 Dark Web Vendors for Selling Illicit Goods
Stolen YouTube Channel Credentials is highly demanded in Dark Web Forum
Hackers selling 267 Million Facebook Identities in Dark Web for 500 Euros
