VTech Breach Exposed Photos of Kids, Chat Logs

While the company acknowledged that the breach affected a server that stored names, emails, encrypted passwords, addresses, download history, and IP addresses, the company did not originally say how many people were affected.

Vtech has also suspended 13 websites following the hacking of its Learning Lodge app database.

The news of this hack, involving the identities of children, comes at a time when tech-based toys are among the most popular this holiday season.

Vtech is best known as a maker of electronic learning devices for children, and late last week it confirmed that data belonging to customers of its Learning Lodge portal was breached in a recent hack. “Upon discovering the breach, we immediately conducted a comprehensive check of the affected site and have taken thorough actions against future attacks”.

While customers’ credit card data was not compromised, the identifying information of some 200,000 children was also exposed. That is in addition to records for 4.9 million adult customers VTech had previously said were affected. But the hacker at the centre of the attack claims to have access to chat logs and personal information.

VTech notes the database did not store credit card information or personal identification data such as social security numbers.

The company says emails have been sent to all account holders informing them of the data breach.

The hacker, whose identity was not revealed, said he or she was able to collect conversations and headshots from the company’s Kid Connect service, which allows parents and kids to chat via a smartphone app and VTech tablet. “The hacked data includes names, email addresses, passwords, and home addresses of 4,833,678 parents who have bought products sold by VTech”, Motherboard reported.

Reporters at Motherboard have obtained images which it reports are head shots of the toy manufacturer’s customers, found on the servers of VTech.

It’s unclear why VTech was targeted, but attorneys general in IL and CT announced that they will investigate the incident. A spokesperson for the company said no further information was available at present, but a further statement would be issued.