If you’ve got young children who have an Innotab console or other ed tech apps and games from Vtech, then you need to pay attention.
Your and your children’s personal data may have been stolen. The Vtech security breach has exposed private data of more than six million children worldwide, including 700,000 British customers.
The games are designed for children age 2-9. The loss reportedly includes thousands of pictures of children and parents, as well as a year’s worth of chat logs, names and addresses.
Where from? Well, the information that parents and children entered in set up or created using the games like Innotab for example. The Innotab using an apps allows children to record voice and text messages, take photos and send these to the matching app on the parents’ phone. The data from both users has been lost. The link is the registered email account that connects both child’s toy, and parent’s phone, via the downloaded app.
And why kids’ photos may be included, is that during the set up, a profile photo can be taken by the child, and stored and used in a similar way to social media sites.
VTech’s Learning Lodge app store customer database is affected and VTech Kid Connect servers accessed. As a precautionary step, Vtech says on their website, they have suspended Learning Lodge, the Kid Connect network and a dozen websites temporarily whilst they ‘conduct a thorough security assessment’.
Reactions
One mum spoke to Good Morning Britain about how she felt when she discovered information about her child may have been stolen.
She says she hadn’t received any notification about the loss from VTech and didn’t know about it until she saw it on the six o’clock news. She then pro-actively contacted VTech customer services.
VTech’s response was confused, first telling her they had not lost data related to the KidConnect app – but in a later email say they did.
What’s disappointing in GMB’s coverage they focused in the VTech story on how disappointing this would be for the toymaker VTech in the run up to Christmas.
There was little information for families on what this could mean for using the toys safely in future. They went on to talk about some other web based tools, but didn’t talk about data protection which really should be much stronger for children’s data.
While parents must take an active role in thinking ahead for our children and how their digital identities can be compromised, we also need to be able to rely on organisations with whom we entrust our own and our children’s personal data, and know that when they ask us for data that they will look after it securely, and use it in ways we expect. On the technical side, data security systems need to be proportionate to the risks they place children in, if data are breached. This is true of commercial companies and public bodies.
On the human side, public transparency and good communication are key to managing expectations, to ensure we know what users sign up to, and to know what happens if things go wrong.
Sadly VTech is continuing to downplay the loss of children’s personal data. In their first statement their focus was to tell people not to worry because credit card details were not included.
When I asked five days after the breach was announced, VTech declined to confirm to me whether avatars and profile pictures had been accessed, arguing that its internal investigation is still ongoing. That’s now two weeks ago.
Their FAQs still say this is unknown. If this is true it would appear surprisingly incompetent on the part of VTech to know that all the other items have been lost in detail, but not profile pictures.
That it is possible for personal details that include date of birth, address and photo to all be lost together is clearly a significant threat for identity theft. It shows one risk of having so much identifiable personal data stored in one place.
The good news, is that it appears not to have any malicious motive. According to the report in Motherboard; “The hacker who broke into VTech’s systems […] that he never intended to release the data to the public.
”Frankly, it makes me sick that I was able to get all this stuff,” the hacker told [Motherboard] in an encrypted chat on Monday.
Could this be the biggest consumer breach of children’s personal data in history?
What now for the 700,000 users of the systems?
Parent accounts need to be directly and fully informed by VTech:
a) what was compromised, by platform, by website, or by customer
b) if and how they will be able to use their equipment again
c) how children’s data would be made safe in future and what Vtech are doing that will different from how they handled data before
Any organisation needs to demonstrate through full transparency and how it acts in the event of such a breach, that it is worthy of trust.
The children’s toys and systems appear to have been shut down.
They’re not cheap with the Innotab coming in at around £90 and its cartridge games upwards of £17 each. Toy sellers will be in the front line for public facing questions in the shops. Anyone that had already bought these just before Christmas will be wondering what to do now, if access to the systems and the apps have been shut down, they won’t work.
And if and when they do work, will they work securely?
Did Vtech contact you and tell you about the breach?
The sensible thing is to stop using that email address, change the password at very minimum and not only on the adult’s phone and child’s game app, but also anywhere else you use it.
What else do you need to know?
What do parents do when their child’s digital identity has been compromised?
More information is needed from the company, and soon.
####
If you want to get in touch, come over and visit defenddigitalme.com You can also sign up to the Twitter group, support the campaign to get 8 million school pupils’ data made safe, or leave a comment.
####
References:
VTech website FAQs as of December 3, 2015
November 28, 2015: blog TryHunt.com by Microsoft MVP for Developer Security
December 1, 2015: Motherboard report by @josephfcox
December 1, 2015: Motherboard article by Lorenzo Franceschi-Bicchierai