Police in the UK have arrested a yet-to-be named 21-year-old in connection to the November breach of toymaker VTech. The man was arrested in Bracknell, about 30 miles outside of London. He is currently being detained on two offences under the Computer Misuse Act, including unauthorised access to a computer and causing a computer to enable unauthorised access to data.
The breach of VTech resulted in the theft of records of 5 million parents and 6.4 million children. Data stolen included account data, such as user names and passwords, along with personal data including names, email addresses, physical addresses, and ip addresses. It was later revealed that the hacker also gained access to gigabytes worth of headshots and chat logs from the company’s young users.
We first heard of the hack in November when an unidentified hacker spoke to the ‘Motherboard’ website. During the interview the hacker stated that they were not intending to sell or otherwise release the VTech data. As for gaining access, this appeared to be trivial, as the hacker made use of an SQL injection attack to gain root access to the server which enabled him to access what he pleased.
Source: arstechnica