about the security vulnerabilities with the journalist and detailed the breach. Bicchierai then reached out to information security researcher Troy Hunt to examine data provided by the attacker to Bicchierai, and to confirm if the leak was indeed authentic and not an internet hoax. Hunt examined the information and confirmed it appeared to be authentic. Hunt then dissected the data in detail and published the findings on his website. According to Hunt, VTech's servers failed to utilize basic SSL encryption to secure the personal data in transit from the devices to VTech's servers; that VTech stored customer information in unencrypted plaintext, failed to securely hash or salt passwords. The attack leveraged an SQL injection to gain privileged root access to VTech servers. Once privileged access was acquired, the attacker exfiltrated the data, including some 190 gigabytes of photographs of children and adults, detailed chat logs between parents and children which spanned over the course of years and voice recordings, all unencrypted and stored in plain text. The attacker shared some 3,832 image files with the journalist for verification purposes, and some redacted photographs were published by the journalist. Commenting on the leak, the unidentified hacker expressed their disgust with being able to so easily obtain access to such a large trove of data, saying: "Frankly, it makes me sick that I was able to get all this stuff. VTech should have the book thrown at them" and explained their rationale for going to the press was because they felt VTech would have ignored their reports and concerns. VTech corporate security was unaware their systems had been compromised and the breach was first brought to their attention after being contacted by Bicchierai prior to publication of the article. Upon notification, the company took a dozen or so websites and services offline. In an FAQ published by the company, they explain some 4,854,209 accounts belonging to parents and 6,368,509 profiles belonging to children had been compromised. The company further claims the passwords had been encrypted, which is contrary to reports by the independent security researcher contacted by Vice. The company indicated they were working with unspecified "local authorities". VTech subsequently brought in the information security services company FireEye to manage incident response and audit the security of their platform going forward. Mark Nunnikhoven of Trend Micro criticized the company's handling of the incident and called their FAQ "wishy-washy corporate speak". United States