Teens, Tweens Risk Identity Theft After 3.3 MillIon Hello Kitty Accounts Get Hacked
SAN FRANCISCO (CBS SF) -- If you or your child has an account on the popular Tokyo-based J-Pop website Hello Kitty, you should change the password. An online security researcher has discovered a massive breach in several Sanrio-owned websites.
Chris Vickery told the security blog Salted Hash he discovered a database leak exposing some 3.3 million sanriotown.com accounts.
The leaked data includes names, decipherable encoded birth dates, gender, email addresses, passwords, as well as password hints, questions and corresponding answers. Kids' personal data on Sanrio gaming and community forums may also have been exposed.
The accounts were registered via hellokitty.com, hellokitty.com.sg, hellokitty.com.my, hellokitty.com.in, and mymelody.com.
Given Hello Kitty's fan base of teens, tweens, and kids under 10, "the immediate concern is that the database might contain the personal information of children."
Officials at Sanrio remain cautiously guarded about the breach and have yet to verify exactly how many of the accounts belong to minors.
In a statement to WIRED, a Sanrio spokesperson said, "the alleged security breach of the SanrioTown site is currently under investigation. Information will be made available once confirmed."
Meantime, security experts advise Hello Kitty users to preemptively change their passwords on all of their Sanrio websites, as well as with any other website where the same password was used. They warn that identity theft is a serious problem when it comes to children.
"While having sensitive details exposed is bad enough for adults, when the information relates to a child – it's worse. If someone managed to compromise a child's identity, the fraud might not be detected for years, because most parents don't monitor their child's credit record."
CBSSF.com writer, producer Jan Mabry is also executive producer and host of The Bronze Report. She lives in Northern California. Follow her on Twitter @janmabr.