CloudPets Data Breach (2017): What Was Exposed & What To Do

What happened

In January 2017, CloudPets left a database publicly exposed on the internet. External parties downloaded the data, and the company later received three separate ransom demands. Public reporting at the time stated that 584,000 people were affected. A subset of 583,000 records was later shared with the Have I Been Pwned service through a data trader; those records contained email addresses and bcrypt password hashes. The full set of exposed records exceeded 821,000 and also referenced children’s names along with portrait photos and voice recordings.

How a breach like this happens

Incidents involving publicly accessible databases usually begin with a configuration error that leaves storage systems reachable without authentication. Once the data is visible, automated scanning tools can locate it quickly. Copies may then be downloaded by multiple parties before the exposure is noticed and corrected. Ransom demands sometimes follow if the data is later offered for sale or used to pressure the affected organisation.

CloudPets and its sector

CloudPets produced connected teddy bears designed to record a child’s voice and transmit the recording to family members through an internet service. Devices of this type collect account details, contact information, and media files that link children to their relatives. Because the service stores both adult and child data in the same system, any exposure can affect multiple members of the same household.

What was likely exposed

The records confirmed as shared include email addresses, family members’ names, and bcrypt-hashed passwords. Additional fields in the larger set of more than 821,000 records referenced children’s names and pointed to portrait photos and voice recordings. The precise contents of every record remain unconfirmed beyond these categories, and no further breakdown of file types or additional data fields has been published.

The real-world impact

Individuals whose email addresses and password hashes appeared in the data may receive unsolicited messages or see attempts to reuse credentials on other sites. References to children’s names and media files create a narrower but longer-term privacy concern for families. For the company, the incident required remediation of the exposed database and response to ransom demands, while users had to decide whether to change passwords and monitor accounts linked to the service.

What to do if you're exposed

Begin by changing the password associated with the CloudPets account and any other accounts that used the same or similar credentials. Enable two-factor authentication wherever it is available. Review email inboxes for unexpected messages that reference the service. Readers can also run a free exposure scan of their email address against known breach data to check whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.