Breach Disclosure: Club Penguin Rewritten 2

Club Penguin Rewritten is a massive multiplayer online game spinoff from the popular game Club Penguin. This week, a second data breach was discovered, exposing 4 million records from their userbase. This breach consists of emails, IP addresses, usernames and bcrypt hashed passwords. This breach adds onto a previous breach of 1.7 million records back in April 2019 already documented by Alpha Team.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

No official statement has been published by the owners of Club Penguin Rewritten (CPRewritten) or by their Twitter account. According to the fandom wiki page for CPRewritten, the game had 4 million registered accounts as of April 2019. Theoretically, the breach could affect the entire user base.