Breach Disclosure: Animal Jam

Breach Disclosure: Animal Jam

Animal Jam, a popular online game and app aimed at children, has suffered a data breach impacting almost 40 million users. This data breach was put up for sale on a popular hacker forum. The leaked data contains usernames, IP addresses, dates of birth, physical addresses, parent names and passwords stored as PBKDF2 hashes of users.

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Between approximately the 10th-12th October 2020, hackers managed to penetrate a server operated by WildWorks, a third-party vendor used by Animal Jam for intra-company communication. WildWorks were notified by researchers when they discovered the database for sale on a popular hacker forum on November 11th 2020. Animal Jam have released a statement notifying users of the breach and outlining the data which was obtained by the hackers. As a precaution all user passwords have been reset.

This data consists of:

• Email addresses used to create approximately 7 million Animal Jam and Animal Jam Classic parent accounts
• Approximately 32 million player usernames associated with these parent accounts
• Passwords associated with those user accounts, but in encrypted form
• 14.8M records include the birth year the player entered at account creation
• 23.9M records include the gender the player entered at account creation
• 5.7M accounts include the full birthday the player entered at account registration
• 12,653 of the parent accounts include a parent’s full name and billing address (but no other billing info)
• 16,131 of the parent accounts include a parent’s first and last name, without a billing address

The database being sold appears to have originated from the hacker under the alias of ShinyHunters, which has recently been selling and distributing breached data from multiple companies via popular hacker forums.

Figure 1: Animal Jam database ad on a popular hacker forum.

Figure 2: Schema from the SQL dump of the breached data.

Since the data has been available, other users of the hacker forum are beginning to use their resources to crack the hashes from the breached data and sell clear text credentials.

Figure 3: Ad offering to sell 500,000 cracked sets of credentials