Neopets security breach

[phantasia]

We have some serious news today. Thanks to an anonymous tipster, we've been made aware that the database and source code for Neopets.com has been breached, and over 69,000,000 user accounts have been exposed.

Full account information, such as email address, passwords, gender, IP addresses, countries, and birthdays are available for sale on a hacker website.

Access to the full database and a copy of Neopets.com source code is being offered for 4 Bitcoin (~$94,500 USD at time of writing). For an additional fee, the seller is offering live access to the database.

You may have read or heard of some reddit posts being made over the past few months by a user who claims to have had live access to the Neopets database and source code since late last year. (Posting about things such as users who gamed the Mystery Pic contest with the Scary Tree Stamp as a prize, or users who have been shadowbanned from the Altador Cup.) TNT has failed to address this security leak, and now we're finding someone else selling access on the black market.

What Can I Do to Protect My Account?
Due to the nature of live access being available, we do not recommend changing your account password or PIN at this time. (The hacker and/or buyer could just get a new copy of whatever you changed your password to with their live access.) We will post an update when it's safe to update your account credentials.

This isn't the first time the Neopets.com site has been breached, and is likely not the last. We cannot emphasize enough that you should be using unique passwords across every website. If you share your Neopets.com password with any other websites, those accounts are highly at risk. Paying $95k to hack Neopets accounts seems pricey, but the value in a purchase like this will be the ability to test your Neopets.com password on many other sites in brute force attacks. Upgrading your digital lifestyle to include a password manager, such as 1Password, will greatly reduce your risk going forward.

I am sure more of you have seen this on Jelly neo. Any thoughts? Are you concerned?
I have a very spesifically diffrent password for my neopets account but I use a variation of it on all my neopets account so a hacker might try it on my other accounts thinking I use that on all sites

[Shawn]

Oh wow, I didn't see that at all.

I can't remember off the top of my head how many accounts were in the previous breach, it could be the same number. If this is a new breach, database access + source code sounds very familiar hmmm.....


Please delete the images if it's not allowed

Please log in to view spoilers.

[oventoast]

$95k! Wow.

How embarrassing for the current website to be compromised again. That is just sad.

[Buizel]

This site needs to actually update their security....this should be a priority. :/

[Hollow]

Welp. It's wild that that's happened again. Considering how broken the website is I'm not all that surprised however I am concerned at how easily this seems to have happened.

[♥ Dita ♥]

Oh shit. Well that is nerve wracking 😰 I use unique password but man am I worried! I would cry if I lost my account to a hack like that. I can't believe they are selling it for so much though. If TNT doesn't do anything now about this leak I swear they don't care at this point since they have let neo_truth go on this long. I know it can't be easy but you have to start protecting the userbase

[oventoast]

REALLY annoyed at how many people on the neopets site events board were gassing up neo_truths while villainizing us lmao

[j03]

Due to the nature of live access being available, we do not recommend changing your account password or PIN at this time. (The hacker and/or buyer could just get a new copy of whatever you changed your password to with their live access.) We will post an update when it's safe to update your account credentials.

This is the worst advice in this scenario. Of course you should be changing your password continuously throughout this process. It's the best action to protect your accounts from any potential damage. Using a trusted password manager will make it much easier for you too.

-

Perhaps this is related to the scumbag posting on reddit often these days. I'm sorry but this needs to be said. Attempting to "expose" our community/cheaters while failing and making mistakes, all while doing absolutely nothing for the game. This person could be reporting the dangerous exploits they have discovered to help save the game from any further damage, but they clearly don't care about it. They'd rather try and entertain a crowd of immature players.

[Shawn]

Sounds exactly like the reddit guy.

But with the number of people with active live DB access, it was only a matter of time before someone did something like this.

[Alister]

Oh shit. I have unique passwords but I'm just thinking of the fallout here, the ramifications are potentially incredible.

Who votes cK crowdsources the $95k ourselves and we just buy the whole damn site