i-Dressup 2016 Data Breach
Platform · Children’s dress-up and casual games · Browser-based gaming platform · Global
i-Dressup Children's Casual Gaming Platform Breach (2016): 2.2 Million Young Player Accounts Including Passwords Exposed
Online gaming site focused on dress-up and casual games for younger audiences. Users interact through browser-based games, often with optional accounts and light personalization features.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
65/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
RestrictedBeing associated with this breach can itself be harmful. Disclosure is limited and presence is not confirmed to unverified parties.
2.2MRecords
2016Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
MinorsChildren / minors
Breach Summary
i-Dressup, an online dress-up and casual gaming website operated by Unixiz, Inc. and directed primarily at children, suffered a data breach in mid-2016 when an attacker exploited what the U.S. Federal Trade Commission later described as commonly known and reasonably foreseeable vulnerabilities. The attacker accessed the personal information of approximately 2.1 million users, including approximately 245,000 users who had indicated on registration that they were under 13 years of age. The attacker contacted i-Dressup with a warning that went unheeded and subsequently sent the breach data to journalists. i-Dressup discovered the intrusion in September 2016. The breach was redistributed as part of a larger corpus of data and was indexed by Have I Been Pwned and DataBreach.com on January 28-29, 2025. The breach affected approximately 2.1 million to 2.2 million users based on records indexed by breach-tracking services. Compromised fields included email addresses, usernames, dates of birth, and passwords. Critically, i-Dressup stored and transmitted user passwords in plaintext rather than as hashed values, exposing the original credentials directly. The FTC also documented that i-Dressup failed to perform vulnerability testing of its network even for well-known threats such as SQL injection, did not implement intrusion detection or prevention systems, and did not monitor for security incidents. For affected users and the parents and guardians of the approximately 245,000 affected children under 13, the practical risk profile combines credential-reuse exposure with significant child-safety concerns. Because i-Dressup stored passwords in plaintext, any account where the user reused the same password was immediately compromised, with credential-stuffing risks expected on email, gaming, and other accounts. Date of birth and email exposure for minors raises additional risks because child personal information has long-tail value for identity fraud that can go undetected for years until the child applies for credit, financial accounts, or employment as a young adult. Parents and guardians should freeze credit at all three U.S. bureaus for any minor children whose data may have been exposed, change any reused passwords for the child or their family members, and remain alert to phishing or social-engineering attempts referencing children's gaming accounts. Because i-Dressup is no longer operating, affected individuals will not receive direct notification and should treat any credentials that may have been used on the platform as fully compromised across all uses.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
2.2M records analyzed
About i-Dressup
i-Dressup was an online dress-up and casual gaming website operated by Unixiz, Inc., headquartered in California, with CEO Zhijun Liu and Secretary Xichen Zhang as named officers. The site allowed users to play dress-up games, design clothes, and decorate virtual personal spaces, alongside social and community features that included blog posting and user-to-user communication. i-Dressup's user base was concentrated in younger audiences, with the site stating that most members were 'boys and girls between 7 and 17,' and the company was subject to the U.S. Children's Online Privacy Protection Act (COPPA). The site is now defunct, having been forced offline by the New Jersey Department of Consumer Affairs and ultimately shut down following federal enforcement action.
Why They Hold Your Data
Children’s casual gaming platforms collect user accounts, usernames, emails, device data, gameplay activity, and in some cases profile details tied to browser-based play.
Recent Developments
i-Dressup is no longer operating. Following the 2016 breach disclosure and a New Jersey Department of Consumer Affairs action that took the site offline, the U.S. Federal Trade Commission and the U.S. Department of Justice filed a 2019 complaint against Unixiz, Inc., CEO Zhijun Liu, and Secretary Xichen Zhang for violations of the Children's Online Privacy Protection Act. The FTC settled the case in April 2019, with the defendants agreeing to pay a $35,000 civil penalty and accepting a permanent prohibition against violating COPPA in the future. The settlement also bars the defendants from collecting, selling, or sharing personal information until they implement a comprehensive data security program with biennial independent assessments. The case has been widely cited as a leading example of FTC enforcement combining COPPA parental-consent violations with data-security failures and as illustrating the regulatory consequences of inadequate child-data protection.
Data Points Exposed
2 verified field types
Email Address
Password High
Breach Impact
The institutional impact on i-Dressup was effectively terminal. The site was forced offline by the New Jersey Department of Consumer Affairs and ultimately shut down following the FTC settlement. Unixiz, Inc. and named officers Zhijun Liu and Xichen Zhang accepted a $35,000 civil penalty plus permanent COPPA compliance obligations. The case has been formally cited in subsequent FTC enforcement actions and in industry guidance about COPPA's data-security requirements, which had previously been less prominent than its parental-consent provisions. Reputational impact extended across the children's online gaming sector and contributed to ongoing regulatory and parental scrutiny of casual children's gaming platforms.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A breach involving minors: identity data on children carries long-tail identity-theft and safeguarding risk. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Protect Yourself: Limited Disclosure
Check Exposure: Verification Required
Because this breach involves data about minors, we do not confirm whether any individual appears in it to unverified parties. A verified parent, guardian, or the individual can privately check exposure.
We confirm exposure only to the affected individual or their verified parent or guardian.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation