A data breach at SanrioTown.com, the online community for Hello Kitty fans, has leaked details of more than 3 million user accounts online.
The information exposed in the breach includes the first and last names, birth dates, genders, countries of origin, and email addresses for 3.3 million accounts.
It also includes lightly-protected passwords, as well as the forgotten password questions and answers. The passwords themselves are “hashed”, a form of protection which renders it technically impossible to retrieve the original password. However, the hashing technique used by SanrioTown leaves it easy for an attacker to use force to uncover a significant proportion of the obscured passwords. The database was available online, where it was found by researcher Chris Vickery, who contacted security blog Salted Hash with the information over the weekend.
As well as SanrioTown itself, accounts from a number of other Hello Kitty websites were also included in the leak: according to Salted Hash, those are hellokitty.com, hellokitty.com.sg, hellokitty.com.my, hellokitty.in.th, and mymelody.com. Two backup servers were also discovered online. Sanrio, the owner of the brand based on the popular anthropomorphised character, has not publicly responded to the allegations of an account leak.
It’s the second major leak of information from a child-focused product in a month. In late November, electronic toymaker VTech was hacked, with customer data for millions of children stolen. The VTech hack even saw the theft of photos taken by the company’s toys, as well as download histories, encrypted passwords and password retrieval questions. A 21 year old man from Berkshire was arrested for the hack on 15 December.
