Anatomy of a Breach

Anatomy of a Breach: VTech — 6.4 Million Children's Accounts, Photos, and Chat Logs

> series: anatomy_of_a_breach —— part: 083 —— target: vtech —— children_affected: 6,400,000 —— data: photos_chat_logs<span class="cursor-blink">_</span>_

Hedgehog Security 30 November 2015 13 min read

6.4 million children. Their photos. Their chat logs. Stolen from a toy company.

In November 2015, a hacker breached VTech's Learning Lodge app store platform and its Kid Connect messaging service, compromising the accounts of approximately 6.4 million children and 4.9 million parent accounts across multiple countries. The stolen data included children's names, dates of birth, genders, and — most disturbingly — profile photographs of children and text and audio chat logs exchanged between parents and their children through VTech's Kid Connect service.

The hacker, who disclosed the breach to Motherboard journalist Lorenzo Franceschi-Bicchierai rather than publishing the data, stated that VTech's security was 'pretty bad' — with SQL injection vulnerabilities, passwords stored as unsalted MD5 hashes, and no SSL encryption on data transmissions between the toys and VTech's servers. The hacker claimed to have no intention of publishing the children's data, but the fact that it was accessible through basic exploitation techniques meant that less principled attackers could have obtained — and misused — the same data.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

The most sensitive category with the weakest protection.

The VTech breach was the first major data breach to specifically affect millions of children — and the inclusion of photographs and chat logs made it uniquely alarming. Children's data requires the highest level of protection under data protection law (including specific provisions under UK GDPR and the Children's Code), yet VTech's security was among the worst documented in any breach: SQL injection, MD5 passwords, no HTTPS.

6.4 Million Children Exposed
The scale — 6.4 million children's accounts — made this the largest breach of children's data in history. The stolen data could be used for identity theft that might not be discovered for years (until the child applies for credit), targeted social engineering of families, or worse. Organisations processing children's data have an elevated duty of care that our <a href="/blog/sector-under-the-microscope-education">education sector analysis</a> examines.
Photos and Chat Logs of Children
The breach exposed photographs of children and private chat logs between parents and their children — data of extraordinary sensitivity. The fact that this data was stored with minimal security protections demonstrates a catastrophic failure in VTech's approach to data protection.
SQL Injection and MD5 — In a Children's Product
VTech's security included SQL injection vulnerabilities (the same flaw exploited in the <a href="/blog/anatomy-of-a-breach-talktalk">TalkTalk breach</a> one month earlier) and passwords stored as unsalted MD5 hashes (the same weak storage that compromised <a href="/blog/anatomy-of-a-breach-linkedin">LinkedIn</a> and <a href="/blog/anatomy-of-a-breach-credential-dump-summer">Last.fm</a>). Our <a href="/penetration-testing/web-application">web application testing</a> identifies these vulnerabilities.
IoT Security Deficit
VTech's connected toys represented the growing Internet of Things — devices that collect and transmit personal data but are often built without security consideration. The VTech breach was among the first to demonstrate the IoT security deficit at scale. <a href="/cyber-essentials">Cyber Essentials</a> addresses IoT device security as part of the connected device baseline.

An elevated duty of care that demands elevated security.

For any organisation processing children's data — schools, nurseries, toy manufacturers, edtech platforms, children's charities — the VTech breach established that children's data requires security commensurate with its sensitivity, not with the organisation's size or technical capability. Under UK GDPR and the Age Appropriate Design Code (Children's Code), the regulatory obligations are explicit and the consequences of failure are severe.

Our web application testing and API testing identify the vulnerabilities that VTech's platform contained. Our education sector analysis examines the specific security requirements for organisations handling children's data. Cyber Essentials certification establishes the baseline. SOC in a Box provides continuous monitoring. And UK Cyber Defence provides incident response when children's data is at risk.


VTech stored children's photos with SQL injection and MD5 passwords. Does your organisation handle children's data?

Our <a href="/penetration-testing/web-application">application testing</a> ensures your platform is not the next VTech. <a href="/cyber-essentials">Cyber Essentials</a> establishes the baseline. Because children's data demands the highest protection — not the lowest.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles