VTech Hack Exposes Data On 4.8 Million Adults, 200,000 Kids (vice.com)

New submitter lorenzofb writes: A hacker broke into the site of the popular toy company VTech and was able to easily get 4.8 million credentials, and 227k kids' identities using SQL injection. The company didn't find out about the breach until Motherboard told them. According to Have I Been Pwned, this is the fourth largest consumer data breach ever. "[Security specialist Troy Hunt] said that VTech doesn't use SSL web encryption anywhere, and transmits data such as passwords completely unprotected. ... Hunt also found that the company's websites "leak extensive data" from their databases and APIs—so much that an attacker could get a lot of data about the parents or kids just by taking advantage of these flaws."

Comments

Honestly ...

[gstoddart]

VTech doesn't use SSL web encryption anywhere, and transmits data such as passwords completely unprotected. ... Hunt also found that the company's websites "leak extensive data" from their databases and APIsâ"so much that an attacker could get a lot of data about the parents or kids just by taking advantage of these flaws

Just stop using this crap ... over and over and over and over we see these same damned stories.

Stop handing all this information over to companies who are too indifferent and incompetent to give a shit about how badly they misuse your data.

Re:Honestly ...

[matthewv789]

The problem is 99% of the population has no idea, and will never have any idea. And neither do the websites' owners. Asking a handful of nerds not to use their site is not going to do any good, and sending them an email telling them their site sucks isn't going to help much either.

These sites will still be just as insecure in 15 years if there isn't a legal requirement to use encryption, hash passwords, and pass at least basic automated scans for SQL injection, XSS, and other common attacks. Seriously, outside of the dot.com/web services space, financial services and e-commerce where they have to pass PCI, this level of insecurity is extremely widespread, at all sizes of companies, and it's not changing any time soon.

Re: If you write SQL injections

[liqu1d]

You're probably right as the majority of "web developers" these days have it all prebuilt into Wordpress for them.

Re:Come on

[gstoddart]

This is just embarrassing. There's absolutely zero excuse for SQLi these days.

Define 'excuse'.

Lazy. Incompetent. Indifferent. Greedy.

The usual set of 'excuses' apply here. And as long as companies have no liability for crap like this, it will keep happening.