i-Dressup Data Breach

Ars Technica reported in September 2016 that the attacker said the download took about three weeks, and the FTC says the operators learned of the access in September. July 15 is therefore not a confirmed exact intrusion, discovery, extraction, or publication date.

A public breach source says it authenticated 2,191,565 unique email addresses with email and plaintext-password classes. Ars relayed the attacker's claim of downloading more than 2.2 million email/password records and that the flaw could expose more than 5.5 million database entries; 5.5 million is not a verified exposure total. The FTC says information for approximately 2.1 million users was accessed and about 245,000 users had indicated they were under 13. That aggregate finding does not establish that any particular email belonged to a child.

The local searchable subset contains 2,188,620 email documents; passwords and other fields were not imported into local search. A result can establish only that the queried email occurs in this local subset attributed to i-Dressup. It cannot establish identity, membership, age, child or parent status, password presence or reuse, field co-occurrence, or misuse. A negative result covers only the local email subset. Only a person who independently knows the old i-Dressup password and confirms that it was reused elsewhere should replace that password.