logo

Update: Neopets Is Still A Thing And Its Exposing Sensitive Data

ID: ed8da006-8652-5300-a5b4-7c9240b6239b

STIX ID: report--ed8da006-8652-5300-a5b4-7c9240b6239b

Feed Name: Security Ledger

Threat Score
70/100

Date Published: 2020-12-28

Date Updated: 2026-04-26

Author: Paul Roberts

...
...

A misconfigured/old Neopets monitoring server and exposed subdomain allowed researchers to access and download the site's internal codebase, hard-coded database credentials, employee emails, visitor IP addresses and private repositories; researchers reported the issue and screenshots, while Neopets claims the files were old internal test data and that no current user data was exposed, though the exposure presents significant legal and security risk given the site's large userbase (many children) and prior breach history.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.