Important Security Message for your VTech Learning Lodge Account

[Skyline]

We bought our Grandson a vtech leapfrog tablet about 2 years ago (Kids learning tablet).

Got this email this morning. Is there anything I should/can do? Or should I just not worry about it?

I haven't clicked on any of the links.

--------------


Dear Valued Customer,

On November 24 HKT we discovered that an unauthorized party accessed VTech customer data on our Learning Lodge app store customer database on November 14 HKT. Our records show that you are a customer of the Learning Lodge.

Our customer database contains general user profile information including name, email address, encrypted password, secret question and answer for password retrieval, IP address, mailing address and download history.

It is important to note that our customer database does not contain any credit card or banking information. VTech does not process or store any customer credit card data on the Learning Lodge website. To complete the payment or check-out process of any downloads made on the Learning Lodge website, our customers are directed to a secure, third party payment gateway.

In addition, our customer database does not contain any personal identification data (such as ID card numbers, Social Security numbers or driving license numbers).

Upon discovering the unauthorized access we immediately conducted a thorough investigation, which involved a comprehensive check of the affected site and implementation of measures to defend against any further attacks. Our investigation continues as we look at additional ways to strengthen our Learning Lodge database security.

We will contact you again with appropriate further updates. Additionally, updates will also be posted on our website at http://www.vtech.com/en/media/press-releases.

In the meantime should you have any questions you can email us at consumer_services@vtech.com.


Yours sincerely,


King F. Pang
Group President
VTech Holdings Limited

 

[ecoleman]

It doesn't look like they had acces to much. I would change your password and also change the password of any other sites where you use the same password.

 

[Keith W]

Reported on the BBC HERE

As with things like this never click on the links in the email, always type the URL into your browser manually

Change any passwords and remove any personal data that is not needed to keep the account open, or if you no longer need the account close it

 

[Skyline]

Thank you both for the help

 

[sphexx]

Vetch are lying to you. Lots of personal information has been stolen, names d.o.b, names of children linked to parents, photos of kids etc all held unencrypted. Full story here:
http://arstechnica.co.uk/security/2015/11/when-children-are-breached-inside-the-massive-vtech-hack/

Best thing seems to be to log in and change all your details to fictitious ones since there seems to be some difficulty deleting accounts.

EDIT: But there is no evidence the data has been sold or posted on the web.

 

[Skyline]

I have change my name, address, postcode etc. Also deleted my Grandson off there. But it doesn't give me the option to change my email address or close the account.

 

[sphexx]

I have change my name, address, postcode etc. Also deleted my Grandson off there. But it doesn't give me the option to change my email address or close the account.

Yes, there are reports that you cannot delete the account. I always think that deleting the account is pointless anyway because how do you know they have deleted your details. We saw that with TalkTalk - people were being encouraged to change their isp whereas what they needed to do was cancel their credit card etc. I doubt that firms ever delete your details of their system - they must be in backups anyway - because you details are valuable to them.
If they still have your email address then at least they can update you with any further disasters! You don't only have one email address anyway I expect though you should change the password on that address anyway.

 

[ecoleman]

Vetch are lying to you. Lots of personal information has been stolen, names d.o.b, names of children linked to parents, photos of kids etc all held unencrypted. Full story here:
http://arstechnica.co.uk/security/2015/11/when-children-are-breached-inside-the-massive-vtech-hack/

Best thing seems to be to log in and change all your details to fictitious ones since there seems to be some difficulty deleting accounts.

EDIT: But there is no evidence the data has been sold or posted on the web.

All of which is meaningless. The only useful information would be passwords, if you use the same password across different accounts.

 

[sphexx]

All of which is meaningless. The only useful information would be passwords, if you use the same password across different accounts.

If you read the Troy Hunt article you will understand that the password is the least of the problems since it easy to change elsewhere.

 

[ecoleman]

If you read the Troy Hunt article you will understand that the password is the least of the problems since it easy to change elsewhere.

Okay, I read it. Still don't have any meaningful information I could do anything with other than an email address and password.

I may have worked out the names of parents kids and average age groups, but that's not exactly a big secret.