CloudPets Database Exposed, 583K Accounts Compromised Including Children’s Data
What Happened – In January, CloudPets left its customer database publicly accessible. External parties downloaded the data set, which contained email addresses, bcrypt password hashes, children’s names and references to voice recordings. The compromised records (583,503 accounts) were later supplied to HaveIBeenPwned and were the subject of three ransom demands.
Why It Matters for Trust & Control Assurance
- Uncontrolled cloud‑asset configurations breach the control objective of maintaining secure data storage and continuous monitoring.
- Lack of evidence that the database was properly hardened undermines audit readiness across frameworks that require documented configuration controls.
- Demonstrates the need for an automated, continuous control‑mapping program that can surface misconfigurations before they become public exposures.
Who Is Affected – Consumer‑IoT / toy manufacturers, retail e‑commerce platforms handling children’s personal data, and any service that stores user‑generated content in the cloud.
Recommended Actions
- Perform an immediate inventory of all cloud‑hosted databases and verify that none are publicly reachable.
- Deploy continuous configuration‑monitoring tools that generate real‑time alerts on misconfigurations.
- Encrypt personally identifiable information at rest and rotate any exposed credentials.
- Document remediation steps and retain evidence to support audit examinations.
Technical Notes – The exposure resulted from a misconfiguration rather than a software vulnerability; no CVE is associated. Data types leaked include email addresses, bcrypt password hashes, children’s names, and metadata linking to voice recordings. Source: [HaveIBeenPwned – CloudPets breach]