Breach Disclosure: Club Penguin Rewritten

Club Penguin Rewritten is a massive multiplayer online game that is a spinoff of the popular Club Penguin game. In April of 2017, it suffered a data breach as confirmed by its Twitter account. The breach contained 1.7 million records of email addresses, IP addresses, bcrypt password hashes and usernames. The company released a blog post about the incident, but had it subsequently deleted.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Details of the breach are scant. The community post made by the team at Club Penguin Rewritten about the breach is now removed. The official account for the service confirmed a vulnerability in the game source code which caused the breach.