Club Penguin Rewritten (July 2019) Data Breach

What happened

In July 2019, the children's gaming site Club Penguin Rewritten (CPRewritten) suffered a data breach (note: CPRewritten is an independent recreation of Disney's Club Penguin game). In addition to an earlier data breach that impacted 1.7 million accounts, the subsequent breach exposed 4 million unique email addresses alongside IP addresses, usernames and passwords stored as bcrypt hashes.

Exposed data

Recommended actions

• Change your Club Penguin Rewritten (July 2019) password immediately, and update it anywhere you reused the same password.
• Enable two-factor authentication on the affected account and on your critical services (email, banking).
• Watch for targeted phishing emails referencing Club Penguin Rewritten (July 2019) — attackers weaponise breach data quickly.
• Check whether your email address appears in this breach on haveibeenpwned.com.