Animal Jam Children's Online Game Breach (2020): 7 Million Young Player Records Including DOB, Home Address & Passwords Exposed

About Animal Jam

Animal Jam is an online game for children. Players adopt animal avatars and explore a nature-themed virtual world. WildWorks, a Utah studio, runs the platform. It is designed for children aged 7 to 12 and operates under COPPA, the federal law governing data collection from minors. Parents create accounts alongside their children. That design decision matters for understanding what the breach exposed.

Why They Hold Your Data

Children’s online games collect player accounts, usernames, parental contact information, device data, gameplay activity, and payment-adjacent records tied to youth-oriented virtual worlds.

Recent Developments

Animal Jam continues to operate under WildWorks. The company has maintained the platform through content updates and seasonal events. No major organizational or ownership changes have been widely reported since the 2020 breach.

Data Points Exposed

Breach Impact

In November 2020 an attacker posted details of the breach on a hacking forum. WildWorks confirmed it. The company reset passwords and notified users. Where parental email addresses were on file, it contacted parents directly. No payment card data was involved. But the exposed records included children's birth dates, parent email addresses, home addresses, usernames, and IP addresses. The platform's design meant family data was part of the breach. A class-action complaint followed, citing failures under COPPA. The incident is a clear example of the specific obligations that come with building a platform for children. The data of the family comes with the data of the child.

Exploitation & Downstream Threats

• Credential stuffing against reused passwords across other platforms | • Identity verification bypass using name + date of birth combination | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Reset any reused passwords and enable MFA on email first, then financial accounts.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).