The Club Penguin Experience Data Breach

What happened?

In October 2024, The Club Penguin Experience (TCPE) suffered a data breach . The incident exposed over 6k subscribers' email addresses alongside usernames, age groups, passwords stored as bcrypt hashes and in some cases, plain text password hints. TCPE sent prompt disclosure notices to impacted customers following the breach.

When did it happen?

The breach date in the public record is October 14, 2024. The record was added to the catalogue on October 26, 2024 and last updated there on October 26, 2024.

What information was reported as exposed?

• Age groups
• Email addresses
• Password hints
• Passwords
• Usernames

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with The Club Penguin Experience or used thecpexperience.com around October 14, 2024. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.