Disney hacked, apparently by angry Club Penguin fans

Disney was hacked.

According to a new report from BleepingComputer this week, 2.5GB worth of internal company data was stolen from Disney, with some of the data dumped on the controversial photoboard site 4Chan. The data dump includes tools used by Disney software developers as well as some of Disney’s corporate and advertising initiatives.

Who is behind the data theft? It appears to be a fan of the now-defunct online game Club Penguin.

What is Club Penguin?

Club Penguin is a popular online game that Disney acquired in 2007 for $350 million in cash.

At its peak, Club Penguin had approximately 200 million users. However, interest in the game waned over the years, and Disney turned its attention to a new 3D version of the game: Club Penguin Island. The original Club Penguin closed in 2017, the same year the new Club Penguin Island opened. Just a year later, in 2018, Disney also closed Club Penguin.

Club Penguin’s most loyal supporters continue to keep the game alive through private servers, where fans can gather to play unofficial simulated versions of the game. However, Disney has cracked down on the creators of these games. For example, in 2022, Disney has a popular server called “Club Penguin Rewriting” closure three people arrested In recognition of their role in running the unofficial Club Penguin online game.

Club Penguin vs Mickey Mouse Club

Now, some Club Penguin fans appear to be taking revenge on Disney.

BleepingComputer reports that the hacked 4Chan dump of Disney data contained 415 MB of old internal Club Penguin data. This data includes emails, files, designs, etc. However, these specific data are quite old, with most of the dumped material dating back to approximately 7 years ago.

However, the Club Penguin data appears to be only a small part of the 2.5GB of information stolen from Disney.

Hackers were apparently able to use the leaked credentials to access Disney’s Confluence servers, which store data related to Disney’s internal business. The larger leaks consist of newer material, some from this year.

According to data reviewed by BleepingComputer, the stolen Disney data consisted of internally developed tools called Helios and Communicore. Helios is a tool that enables Disney employees to create sensor-based experiences in Disney theme parks. Communicore is a development tool described as a messaging library for decentralized applications.

The stolen documents also included information on a range of Disney projects and links to internal company websites used by Disney developers.

Disney has not yet issued any statement regarding the data breach.