VTech hack: Attack on children’s tablet company ‘revealed personal pictures of kids’

The information includes personal data, which means that the photos and recordings stolen through the hack can be linked to real people, according to the hacker

The VTech InnoTab 2 at the launch of Dream Toys 2012 at St Mary's Church on October 31, 2012 in London, England (Gareth Cattermole/Getty Images)

Hackers who broke into a children’s electronics company have got access to pictures of potentially millions of children.

Cyber attackers broke into Vtech, which makes tablets and other devices for kids, and got into a database that stores kids’ personal information, recordings and images.

The site said last week that it had been hacked and that five million customers had been affected. But the hacker at the centre of the attack claims to have access to chat logs and personal information.

Those include pictures of children taken with the devices’ camera, according to Vice’s Motherboard, who interviewed the hacker.

Security expert Troy Hunt said that all communication through the app was unencrypted, meaning that when a hacker got access to the database all of the information could be read.

Much of the information and pictures can be traced back to specific usernames, meaning that the children and adults in the files can be identified, according to Motherboard.

Motherboard even posted what is claimed to be a recording of a discussion between a child and their parent. It isn’t clear who is talking in the clip or whether it is authentic.

The company has taken down some of its vulnerable portals, including the Learning Lodge app store that was affected in the hack.

A statement posted by VTech acknowledged that “about 5 million customer accounts and related kids profiles worldwide are affected”.

It said that the database that was accessed included profile information such as “name, email address, password, secret question and answer for password retrieval, IP address, mailing address and download history”.

The company stressed that the database didn’t include any credit card information or other payment data. Any payments were sent through a “secure, third party payment gateway”, it said.

It also said that the database doesn’t contain personally identifying information such as ID card numbers or driving license information.