Episode
15 September 2017 Official episode · Official transcript
hacktivism
The episode examines the 2015 compromise of VTech’s online services, including customer and children’s data, and the subsequent disclosure, investigation, remediation, legal actions, and uncertain outcome for the unnamed hacker.
Topics: SQL injection, Root access and privilege escalation, Database compromise and bulk data exfiltration, Lateral movement across internal servers, Unsalted MD5 password hashing, Lack of HTTPS, Unsupported ASP 2.0 deployment, Exposure of children’s names, addresses, photos, chat logs, and voice recordings, Secure anonymous reporter-hacker communications using Signal and PGP, Incident response and service shutdown, Third-party security testing and security audits, Children’s data privacy and COPPA compliance
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Kid Connect DEVELOPED_BY VTech
VTech created Kid Connect to connect a parent’s phone to a child’s tablet.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“The technology VTech created that connects a parent’s phone to a kid’s tablet is called Kid Connect.”
The Learning Lodge DEVELOPED_BY VTech
VTech created The Learning Lodge as its own app store.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“VTech also created its own app store called The Learning Lodge”
VTech Kids’ Toy Hacking case TARGETS VTech
The hacking case involved unauthorized access to VTech customer data and systems.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“He had full access to the planetvtech.com website. 100 percent control of it.”
“an unauthorized party accessed VTech customer data”
VTech Kids’ Toy Hacking case INITIAL_ACCESS_VIA SQL injection
The hacker initially gained access by exploiting SQL injection in planetvtech.com.
Derived Confidence 98% · Jack Rhysider EP 2 Details
“he found it was vulnerable to SQL injection”
“this hacker ran a script against planetvtech.com which attempted to exploit SQL. To his surprise, it worked. He had shell access to the website.”
VTech Kids’ Toy Hacking case INVOLVES root access
After obtaining shell access, the hacker obtained root access to the website.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“A few keystrokes later, he then had root access.”
VTech Kids’ Toy Hacking case INVOLVES lateral movement
The hacker moved from the web server to other servers on the VTech network, including database servers.
Derived Confidence 96% · Jack Rhysider EP 2 Details
“He saw numerous other servers on the VTech network, including a database server. He was able to hop into the database”
VTech Kids’ Toy Hacking case INVOLVES database dump
The hacker downloaded complete copies of multiple VTech databases.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“The hacker grabbed a copy of everything in the database, downloaded the whole thing, then moved on to another database and grabbed a copy of everything there, too.”
VTech Kids’ Toy Hacking case COMPROMISES planetvtech.com
planetvtech.com was one of the vulnerable VTech websites taken offline after the breach.
Explicit Confidence 98% · Jack Rhysider EP 2 Details
“But they did take down the following websites: planetvtech.com, vsmilelink.com, and sleepybearlullabytime.com.”
VTech Kids’ Toy Hacking case COMPROMISES vsmilelink.com
vsmilelink.com was taken offline after the breach.
Explicit Confidence 98% · Jack Rhysider EP 2 Details
“they did take down the following websites: planetvtech.com, vsmilelink.com, and sleepybearlullabytime.com.”
VTech Kids’ Toy Hacking case COMPROMISES sleepybearlullabytime.com
sleepybearlullabytime.com was taken offline after the breach.
Explicit Confidence 98% · Jack Rhysider EP 2 Details
“they did take down the following websites: planetvtech.com, vsmilelink.com, and sleepybearlullabytime.com.”
VTech Kids’ Toy Hacking case INVOLVES MD5
The compromised database stored passwords as basic unsalted MD5 hashes rather than securely encrypted passwords.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“the passwords were stored using a basic unsalted MD5 hash”
VTech Kids’ Toy Hacking case INVOLVES HTTPS
The VTech website did not use HTTPS for authentication or its API.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“the site doesn’t use HTTPS anywhere, not for authentication or the API, nothing.”
VTech Kids’ Toy Hacking case INVOLVES ASP 2.0
The website was running ASP 2.0, which Microsoft had unsupported for more than four years by that time.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“the site was running ASP 2.0 which by that time had been unsupported by Microsoft for over four years.”
VTech Kids’ Toy Hacking case DISCOVERED_BY FireEye
FireEye was hired for incident response and found and resolved security issues after the breach.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“VTech hired a security firm called FireEye to help with incident response. FireEye was able to find the security issues and resolve them.”
VTech ASSOCIATED_WITH Hong Kong
VTech is described as a company based in Hong Kong.
Explicit Confidence 99% · Jack Rhysider EP 2 Details
“VTech is a company based in Hong Kong”
VTech ASSOCIATED_WITH Children’s Online Privacy Protection Act
The FTC found VTech had violated COPPA; VTech agreed to pay the fine while stating it had not violated any laws.
Attributed Confidence 99% · Jack Rhysider EP 2 Details
“the FTC did find VTech to have violated COPPA laws.”
“VTech agreed to pay the $650,000 fine imposed by the FTC but they also issued a press release saying they haven’t violated any laws.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-12T17:46:33.490365+00:00