Neopets 2013 Data Breach
Platform · Virtual pet gaming and community · Online game and social platform · Global
Neopets Virtual Pet Platform Breach (2013): 68 Million User Accounts Including DOB, Location & Passwords Exposed :: Long Disclosure Delay
Virtual pet gaming platform.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
65/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
RestrictedBeing associated with this breach can itself be harmful. Disclosure is limited and presence is not confirmed to unverified parties.
68.5MRecords
2013Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
MinorsChildren / minors
Breach Summary
Neopets, a virtual pet gaming and online community platform, suffered a data breach in approximately 2012 to 2013 (publicly indexed by Have I Been Pwned on July 7, 2016, with a breach-date of May 5, 2013) when attackers exfiltrated a database of user account information from the platform. The breach data circulated among breach-trading communities for several years before being formally indexed in 2016, representing a significant disclosure-delay window during which affected users had no notification of their exposure. The breach was redistributed and indexed by DataBreach.com on December 1, 2024 with an expanded record count that may reflect the inclusion of data from a subsequent 2022 breach in which approximately 69 million Neopets accounts were exfiltrated by a hacker using the alias 'TarTarX' along with the platform's source code. The breach affected approximately 27 million unique email addresses based on records indexed by Have I Been Pwned (with DataBreach.com listing approximately 68.5 million records that may reflect the combined 2013 and 2022 incident scopes). Compromised fields included email addresses, names, usernames, dates of birth, gender, geographic locations including ZIP codes for the U.S. user subset, IP addresses, and passwords stored in plaintext. The plaintext password storage represents a critical security failure that exposes the original credential values directly, with no cryptographic protection of any kind. The exposure of dates of birth combined with the platform's predominantly youth user base means that a substantial proportion of the affected accounts belong to users who were minors at the time of account creation, with many having transitioned to adulthood during the multi-year period between the breach and public disclosure. For affected users, the practical risk profile combines long-running credential-reuse exposure with identity-fraud risk that has accumulated over the substantial gap between the original breach and present-day awareness. The plaintext password exposure means that any account where the user reused the Neopets password is fully compromised, with credential-stuffing risks expected on email, gaming, and other accounts that may have been created with the same password during a user's adolescence and carried forward into adult life. Date of birth and geographic location exposure for users who were minors at the time of the breach creates long-tail identity-fraud risk that may not be apparent until the user applies for adult financial accounts, employment background checks, or government services. Affected users who created Neopets accounts during their childhood should treat any password used on Neopets as fully compromised across all uses, change any potentially reused passwords on current adult accounts including email, banking, and employer accounts, enable two-factor authentication where available, and consider monitoring credit reports for any unauthorized account openings. The 2022 follow-on breach means that affected users should expect additional and ongoing exposure rather than a time-limited incident.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
68.5M records analyzed
About Neopets
Neopets is a virtual pet gaming and online community platform that launched in 1999, allowing users (predominantly children, tweens, and young adults at launch and continuing through the platform's history) to create and care for virtual pets, play browser-based games, participate in community forums, and engage in virtual-economy activities using in-game points (Neopoints) and real-currency-purchased Neocash. The platform has had multiple owners over its history including Viacom, JumpStart, and most recently NetDragon (a Hong Kong-listed online gaming company), with Neopets currently operated as a NetDragon subsidiary headquartered in Hong Kong. As an account-based gaming and community platform with a long-running user base, Neopets maintained extensive user account data including identity, contact information, demographic data, geographic location, IP addresses, gameplay history, and login credentials, with many active accounts dating back to the platform's early years.
Why They Hold Your Data
Online game and community platforms collect player accounts, emails, usernames, friend relationships, gameplay history, purchase records, and social activity tied to youth-oriented virtual worlds.
Recent Developments
Neopets has continued to operate following both the 2013 breach and a subsequent 2022 breach in which a hacker known as 'TarTarX' advertised the sale of approximately 69 million member accounts plus 460 megabytes of compressed Neopets website source code on a hacking forum for approximately four bitcoin (approximately $94,000 at the time). The 2022 incident was acknowledged by Neopets via the platform's Twitter account and a forensic investigation, with Neopets engaging law enforcement and a leading forensics firm. The platform has had documented persistent security weaknesses including a 2020 disclosure by independent researcher John Jackson of exposed credentials, employee emails, and proprietary source code through a misconfigured Apache web server. A separate Reddit user named 'neo_truths' reported having read access to the Neopets database for at least a year before the 2022 incident through exploits found in the leaked source code. The platform has launched NFT-related features and metaverse-game initiatives in recent years under NetDragon ownership.
Data Points Exposed
8 verified field types
Date of Birth High
Email Address
Full Name
Gender
Geographic location
IP Address
Password High
Username
Breach Impact
The institutional impact on Neopets has been moderate across multiple incidents given the platform's continued operation through ownership transitions. Neopets has not been the subject of significant public regulatory action despite the multiple incidents, in part because its Hong Kong-based parent company structure complicates U.S. and EU regulatory enforcement, although the predominantly minor and youth user base would in principle implicate COPPA in the United States. Civil litigation has been limited based on publicly available information. The reputational impact concentrated within the legacy-online-gaming sector and among long-time Neopets users, many of whom have continued to use the platform across multiple ownership transitions and security incidents. The case has been formally cited in cybersecurity industry analyses of long-running gaming platforms as illustrating the persistent risk profile of legacy platforms with substantial historical user data and limited security investment.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Identity verification bypass using name + date of birth combination | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Protect Yourself: Limited Disclosure
Check Exposure: Verification Required
Because this breach involves data about minors, we do not confirm whether any individual appears in it to unverified parties. A verified parent, guardian, or the individual can privately check exposure.
We confirm exposure only to the affected individual or their verified parent or guardian.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation