Animal Jam Data Breach (2020): What Was Exposed & What To Do

In October 2020, the online game Animal Jam experienced a data breach that exposed records tied to 7.1 million individuals. The incident became public on October 12, 2020, after the data later appeared in online hacking communities the following month. The event matters because it involved personal details and credentials from accounts belonging to children and their families, raising the possibility that this information could be used for targeted follow-on activity.

Inside the incident

The breach affected 46 million user accounts containing more than 7 million unique email addresses. Reported data elements included usernames, IP addresses, names, genders, physical addresses, dates of birth (in some cases partial), and passwords stored as PBKDF2 hashes. Parent names appeared in some records. No further details on the method of access, exact timing of the intrusion, or total volume of files have been disclosed.

How a breach like this happens

Incidents involving online platforms often begin with an attacker obtaining entry through stolen credentials, an unpatched server vulnerability, or misconfigured access controls. Once inside, the actor can locate and copy user databases before exfiltrating them. The stolen material may then circulate in closed forums or be offered for sale, extending the window during which the information remains usable even if the original intrusion is later discovered.

About Animal Jam

Animal Jam operates an online game aimed at children and maintains accounts that typically store identifiers, contact details, and authentication data. Because the service addresses a younger audience, it also processes information linked to parents or guardians. A compromise at this scale is consequential because the records can reveal both child and family details that are not routinely exposed in adult-oriented services.

What was likely exposed

The breach listing named specific categories of information. Exact completeness for every account remains unconfirmed, and some fields such as dates of birth were present only partially or for subsets of records.

• Dates of birth
• Email addresses
• Genders
• IP addresses
• Names
• Passwords (PBKDF2 hashes)
• Physical addresses
• Usernames

The real-world impact

Individuals whose records were included face the possibility that email addresses and passwords could be tested against other services, increasing the chance of account takeover elsewhere. IP addresses and physical addresses can support more precise phishing or social-engineering attempts. For the organization, the incident creates ongoing obligations around user notification, credential resets, and potential regulatory scrutiny common to platforms that hold data on minors.

Were you affected?

Users can begin by changing the password on their Animal Jam account and on any other sites where the same password was reused. Enabling two-factor authentication where available adds a further control. Monitoring email for unexpected login attempts or messages that reference the game can surface early signs of misuse. Readers can run a free exposure scan of their email address to check whether their information has appeared in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.