Neopets Data Breach

What happened

In May 2016, a set of breached data originating from the virtual pet website "Neopets" was found being traded online. Allegedly hacked "several years earlier", the data contains sensitive personal information including birthdates, genders and names as well as almost 27 million unique email addresses. Passwords were stored in plain text and IP addresses were also present in the breach.

Exposed data

Recommended actions

• Change your Neopets password immediately, and update it anywhere you reused the same password.
• Enable two-factor authentication on the affected account and on your critical services (email, banking).
• Watch for targeted phishing emails referencing Neopets — attackers weaponise breach data quickly.
• Exposed identity data raises identity-theft risk — consider credit monitoring or a credit freeze.
• Check whether your email address appears in this breach on haveibeenpwned.com.