In July 2022 a database covering more than 69 million Neopets members, together with around 460MB of compressed site source code, was offered for sale for four bitcoin — reported at the time as roughly $94,000. Neopets confirmed a breach and engaged a forensics firm.
Reported contents include names, email addresses, usernames, postal codes, dates of birth, gender, country and the email address used at registration.
The Population Has Aged Out Of The Product
Neopets launched in 1999 and its users were largely children. A registration record from 2003 belongs to somebody who is now in their thirties, does not use the site, and will not read a notification about it.
We filed the retention argument at 22-0922, where a carrier held identity documents for departed customers, and 26-0730. This is its long-tail form: data collected from a minor, retained past the relationship, past the product’s relevance, and past the point where the person would recognise the company’s name in their inbox.
A Birthdate Does Not Expire
No password or payment detail is reported here, and by the desk’s usual scoring that keeps the file low. Birthdate, email address and country do not lose value with time.
They are the fields identity verification and account recovery lean on, and a registration email from twenty years ago is often still the recovery address for something. We have recorded the same durability problem at 26-0721b, where scanned identity documents outlived the monitoring offered, and at 22-0721.
What This File Does Not Establish
How long the intruder had access is not established, and this desk found no reliable public figure for it.
The desk raises that explicitly because it went looking for a long dwell time and did not find one it could stand behind. We have recorded dwell as null rather than as an estimate; an unverified duration attached to a real breach is exactly the kind of claim that gets repeated afterwards as though it were counted.
Built on contemporaneous reporting of the sale listing and Neopets’ confirmation. The >69 million figure, the ~460MB of source code, the four-bitcoin asking price and its reported dollar equivalent, and the data categories are as reported. The duration of access is not established: this desk searched for it, found only vague and partly circular claims, and records dwell as unknown rather than carrying a figure — which is the main reason the file is graded medium. No individual is named. The characterisation of the user base as historically children reflects the site’s well-documented audience, not a claim about any specific record. Corrections: corrections@forensicpost.com.