Home chevron_right Recent Breaches chevron_right Club Penguin Rewritten (January 2018)

Club Penguin Rewritten (January 2018)

HIGH RISK

Data breach — January 2018

In January 2018, the children's gaming site Club Penguin Rewritten (CPRewritten) suffered a data breach (note: CPRewritten is an independent recreation of Disney's Club Penguin game). The incident exposed almost 1.7 million unique email addresses alongside IP addresses, usernames and passwords stored as bcrypt hashes. When contacted, CPRewritten advised they were aware of the breach and had "contacted affected users".

search Check if you were affected — free

1.7M

Records exposed

2018

Year of breach

Data types exposed

Free

To check your email

Data exposed in this breach

mailEmail addresses homeIP addresses lockPasswords personUsernames

What happened in the Club Penguin Rewritten (January 2018) data breach?

The exposed data included 4 types of personal information. Because passwords were exposed, users who reused their password on other sites are at particular risk. Learn more about what a data breach means for you.

Quick answer — was Club Penguin Rewritten (January 2018) hacked?

Yes. Club Penguin Rewritten (January 2018) was breached in January 2018. The breach exposed 1,688,176 records including email addresses, ip addresses, passwords. This breach has been independently verified. If your email was involved, your data may still be at risk today. Check if you were affected.

Why was the Club Penguin Rewritten (January 2018) breach so dangerous?

The Club Penguin Rewritten (January 2018) breach exposed 1,688,176 records — that is 1.7M people whose personal data is now circulating on the dark web. The combination of email addresses, ip addresses, passwords makes this a high-risk breach that requires immediate action.

Because passwords were exposed, attackers can use credential stuffing to automatically test your Club Penguin Rewritten (January 2018) password against hundreds of other websites. If you reused your password anywhere, those accounts are now at risk. Read more about what happens to your data after a breach.

Don't wait to find out — check if your email was exposed in this breach now.

What data was stolen in the Club Penguin Rewritten (January 2018) breach?

warning

Email addresses — used for phishing attacks and credential stuffing against your other accounts

warning

IP addresses — combined with other data, used for identity theft and physical fraud

cancel

Passwords — can be used to access your accounts directly or cracked to reveal your actual password

warning

Usernames — used to build profiles and target you with personalised scams

Is the Club Penguin Rewritten (January 2018) breach still dangerous in 2026?

Yes. Stolen data from the Club Penguin Rewritten (January 2018) breach remains dangerous years after the incident. Research shows that over 65% of stolen credentials from older breaches have never been changed by the account holders. Attackers routinely compile data from multiple breaches to build complete profiles, and credentials from 2018 are still actively used in credential stuffing attacks today.

Personal information like email addresses, phone numbers, and dates of birth never expire. Even if you changed your Club Penguin Rewritten (January 2018) password, the other exposed data can be combined with information from other breaches to target you. Learn more about how long stolen data stays dangerous.

Frequently asked about the Club Penguin Rewritten (January 2018) breach

How many people were affected by the Club Penguin Rewritten (January 2018) data breach? expand_more

Approximately 1,688,176 user records were exposed in the Club Penguin Rewritten (January 2018) breach in January 2018.

Is the Club Penguin Rewritten (January 2018) breach still a risk in 2026? expand_more

Yes. Leaked credentials are actively used in credential stuffing attacks years after a breach. If you reused your Club Penguin Rewritten (January 2018) password elsewhere and haven't changed it, those accounts remain at risk today.

How do I know if my email was in the Club Penguin Rewritten (January 2018) breach? expand_more

Enter your email in the free checker on EmailLeaked. We scan 12 billion+ breach records including the full Club Penguin Rewritten (January 2018) dataset and tell you instantly whether your email was exposed and what data was taken.

What should I do if I was in the Club Penguin Rewritten (January 2018) breach? expand_more

Change your Club Penguin Rewritten (January 2018) password immediately, change any other account where you used the same password, enable two-factor authentication on all important accounts, and monitor for phishing emails over the next 90 days.

Who was affected by the Club Penguin Rewritten (January 2018) breach?

The Club Penguin Rewritten (January 2018) data breach affected approximately 1,688,176 users who had accounts with the service. While not the largest breach on record, it still represents a significant number of compromised accounts in our database of 970+ known breaches.

If you ever created an account with Club Penguin Rewritten (January 2018) or used their services, your data may have been included in this breach. Check your email now to find out. You can also read our guide on what to do immediately after a data breach.

If your email was in the Club Penguin Rewritten (January 2018) breach

Change your Club Penguin Rewritten (January 2018) password immediately

Go to Club Penguin Rewritten (January 2018) and change your password right now. Use a strong, unique password that you have never used anywhere else.

Change any account sharing that password

If you used the same password on other sites, change it on every one of them. Attackers test stolen credentials on hundreds of popular sites within hours.

Enable two-factor authentication

Turn on 2FA on Club Penguin Rewritten (January 2018) and every important account. Even if your password is known, attackers cannot get in without the second factor.