Popular Webkinz World online children’s game hacked, 23M credentials leaked

ZDNet reported that a hacker has leaked 23 million credentials from the Webkinz World online children’s game.

Webkinz are stuffed animals that have a playable online counterpart, www.webkinz.com, in “Webkinz World.” Webkinz were originally released by the Canadian toy company Ganz on April 29, 2005. Each Webkinz toy has an attached tag with a unique “Secret Code” printed on it that allows you to play with your pet in the “Webkinz World” website. On Webkinz World, the Secret Code allows the user to own a virtual version of the pet for online play.

A hacker has leaked the usernames and passwords of nearly 23 million players of Webkinz World on a well-known hacking forum.

ZDNet has obtained the data dump with the help of experts from the data breach monitoring service Under the Breach who also noticed the data leak.

“ZDNet has learned that details about the vulnerability have been circulating online before today’s leak for months, both on hacking forums and on online IM chat groups.” reported ZDNet.

According to Under the Breach, the incident impacted 22,000,000 users, which is likely just a part of the full database stolen by attackers.

The database has a size of 1 GB, it contained 22,982,319 credentials, with the passwords being encrypted with the MD5-Crypt algorithm.

According to ZDNet, the incident took place earlier this month, threat actors exploited a SQL injection issue affecting one of the website’s web forms.

At the time of writing, the Webkinz staff had discovered the breach and addressed the flaw exploited by hackers.

ZDNet reported the incident to Ganz that has yet to reply.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Webkinz World, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.