Laban Sköllermark @[email protected]

Data breach at The Club Penguin Experience. Let me take a moment to point out what an awesome job these folks have done with their disclosure: 1. They sent this out the same week as the breach occurred 2. They say exactly what happened and what was exposed 3. They say “hash” and name bcrypt as the algo used (I’m giving them a free pass for then saying “encrypted”) 4. They explain how bcrypt can still be cracked and you still need to take precautions 5. They’re force-resetting all passwords 6. They offer to delete the account if this incident concerns any victims 7. Separately, they reached out to me to flag this before I had the opportunity to load it into @haveibeenpwned myself I’m of the firm belief that in the era of ubiquitous data breaches, organisations are judged more by how they handle them than they are for having had one in the first place. Massive kudos to TCPE for such a responsible reaction 👏