CloudPets Data Breach

What happened?

In January, the maker of teddy bears that record children's voices and sends them to family and friends via the internet CloudPets left their database publicly exposed and it was subsequently downloaded by external parties (the data was also subject to 3 different ransom demands). 583k records were provided to HIBP via a data trader and included email addresses and bcrypt hashes, but the full extent of user data exposed by the system was over 821k records and also included children's names and references to portrait photos and voice recordings.

When did it happen?

The breach date in the public record is January 1, 2017. The record was added to the catalogue on February 27, 2017 and last updated there on February 27, 2017.

What information was reported as exposed?

• Email addresses
• Family members' names
• Passwords

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with CloudPets or used cloudpets.com around January 1, 2017. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.