Animal Jam – 7.1 M Accounts Breached Exposing Children’s Personal Data
What Happened – In October 2020 the online game Animal Jam suffered a data breach that was posted to public hacking forums in November. The leak contained information for 7,104,998 accounts, including usernames, email addresses, IP addresses, dates of birth (often partial), physical addresses, parent names and passwords stored as PBKDF2 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to protect personally identifiable information of minors—a core privacy control that continuous‑control‑assurance programs are built to monitor and evidence.
- Demonstrable consent‑management and data‑handling evidence are required to show auditors that privacy obligations (e.g., GDPR, COPPA) are being met.
- A robust privacy‑control framework provides the defensible audit trail needed to respond to regulator inquiries and downstream breach notifications.
Who Is Affected – Companies that operate online gaming platforms, especially those targeting children, and any third‑party services that ingest or store similar user‑profile data.
Recommended Actions
- Conduct a privacy impact assessment (PIA) focused on the exposed data elements.
- Verify that consent records, parental‑verification processes, and data‑retention policies meet GDPR/COPPA expectations.
- Rotate all compromised passwords and review hashing algorithms for adequacy.
- Document remediation steps and collect evidence for audit readiness. Source: Have I Been Pwned – Animal Jam breach
Technical Notes
- Breach date: October 2020; public disclosure: November 2020.
- Data types: DOB, email, gender, IP, name, password (PBKDF2 hash), physical address, username, parent name.
- No specific vulnerability disclosed; breach appears to stem from inadequate access controls and data‑handling practices. Source: same as above