1.69M Club Penguin Rewritten Accounts Breached, Exposing Emails, IPs, and Password Hashes
What Happened — In January 2018 the fan‑run recreation of Disney’s Club Penguin (Club Penguin Rewritten) suffered a data breach that exposed 1,688,176 unique user records. The leaked data included email addresses, IP addresses, usernames and bcrypt‑hashed passwords. The operators confirmed the breach and said they had notified affected users.
Why It Matters for Trust & Control Assurance —
- The incident illustrates the risk of inadequate credential protection and the need for continuous monitoring of authentication controls.
- Demonstrates why a defensible audit trail of password‑policy enforcement and hashing standards is essential for audit readiness.
- Highlights the importance of a control‑assurance program that can surface gaps in access‑control governance before a breach occurs. (Relevant capability: Access Controls)
Who Is Affected — Online gaming platforms, child‑focused web services, and any SaaS offering consumer accounts.
Recommended Actions —
- Verify that password storage uses strong, salted hashing algorithms and rotate salts regularly.
- Implement continuous monitoring of login anomalies and enforce multi‑factor authentication where feasible.
- Document credential‑management policies and collect evidence for audit purposes. Source: https://haveibeenpwned.com/api/v3/breach/ClubPenguinRewritten
Technical Notes — The breach exposed email addresses, IP addresses, usernames and bcrypt‑hashed passwords. No specific vulnerability or CVE was disclosed; the attack vector remains unknown. Source: https://haveibeenpwned.com/api/v3/breach/ClubPenguinRewritten