Disney’s biggest cybersecurity threat could be…Club Penguin fans?

Pls share this post

Listen to this article

The feud between Disney and the fans of its defunct Club Penguin game has taken an unexpected security-focused turn after a seemingly fresh database full of sensitive company information was leaked online.

Earlier this week, a threat actor posted a new thread on 4Chan with a simple message: “I no longer need these :)” and held a link to a 415MB archive which contained 137 PDFs with internal information about Club Penguin, an old massive multiplayer online (MMO) game, shut down years ago, but still with a devout following that plays it somewhat illegally. 

The database included emails, design schematics, documentation, and character sheets.

READ ALSO  Cisco alerts users to password-spraying attacks targeting VPN services

Exposed credentials

According to BleepingComputer, which has seen the database firsthand, information in there is seven years old. However, whoever stole this information only posted a part of it. The entire database, apparently grabbed from Disney’s Confluence server, is much larger and apparently, holds newer information, too. The rest seems to be making rounds on Discord.

The publication said that the Confluence servers were breached using previously exposed credentials. An anonymous source also confirmed to the publication that the attackers were initially looking for Club Penguin data but ended up with 2.5GB of Disney’s corporate strategies, advertising plans, Disney+ data, internal developer tools, business projects, and internal infrastructure. 

READ ALSO  AI and Machine Learning will not save the planet (yet)

“Lot more files here including internal api endpoints and credentials for things like S3 buckets,” an anonymous source told BleepingComputer.

Club Penguin, a game designed for children, was developed by New Horizon Interactive and released in 2005. It was acquired by Disney in 2007, and shut down in 2017. That same year, a number of indie developers, not happy with Disney pulling the plug on the game, released Club Penguin Rewritten, essentially a copy of the original game, built on pre-existing Flash files and simulated older versions of the original. It lacked monetization and in-game purchases.

The City of London Police shut the game down in 2022 in compliance with a copyright investigation request from Disney. Three people were arrested. 

READ ALSO  Visa warns dangerous new malware is attacking financial firms

Before the shutdown, the game had more than 11 million registered players.

More from TechRadar Pro


Pls share this post
Previous articleThe Last of Us Part 2 is reportedly ready to launch on PC
Next articleTesla can exist without Elon but the company needs him right now, board chair says