Disney’s biggest cybersecurity threat could be…Club Penguin fans?
The feud between Disney and the fans of its defunct Club Penguin game has taken an unexpected security-focused turn after a seemingly fresh database full of sensitive company information was leaked online.
Earlier this week, a threat actor posted a new thread on 4Chan with a simple message: “I no longer need these :)” and held a link to a 415MB archive which contained 137 PDFs with internal information about Club Penguin, an old massive multiplayer online (MMO) game, shut down years ago, but still with a devout following that plays it somewhat illegally.
The database included emails, design schematics, documentation, and character sheets.
Exposed credentials
According to BleepingComputer, which has seen the database firsthand, information in there is seven years old. However, whoever stole this information only posted a part of it. The entire database, apparently grabbed from Disney’s Confluence server, is much larger and apparently, holds newer information, too. The rest seems to be making rounds on Discord.
The publication said that the Confluence servers were breached using previously exposed credentials. An anonymous source also confirmed to the publication that the attackers were initially looking for Club Penguin data but ended up with 2.5GB of Disney’s corporate strategies, advertising plans, Disney+ data, internal developer tools, business projects, and internal infrastructure.
“Lot more files here including internal api endpoints and credentials for things like S3 buckets,” an anonymous source told BleepingComputer.
Club Penguin, a game designed for children, was developed by New Horizon Interactive and released in 2005. It was acquired by Disney in 2007, and shut down in 2017. That same year, a number of indie developers, not happy with Disney pulling the plug on the game, released Club Penguin Rewritten, essentially a copy of the original game, built on pre-existing Flash files and simulated older versions of the original. It lacked monetization and in-game purchases.
The City of London Police shut the game down in 2022 in compliance with a copyright investigation request from Disney. Three people were arrested.
Before the shutdown, the game had more than 11 million registered players.
