Animal Jam Classic is a game with thousands of players, many of whom have provided sensitive personal data by purchasing membership.

The game has suffered a breach in 2020 which exposed millions of usernames, passwords, emails and IP addresses. Due to this breach many players today now suffer from their childhood accounts being hacked with their in-game items stolen.

To combat this Animal Jam Classic has a 2-factor authentication feature which sends the parent email a 6-digit code with a 15-minute leeway to log into their account.

Unfortunately, hackers are STILL able to bypass this protection, testing showed that while Animal Jam limits the number of 2FA attempts from a single IP address, an attacker can simply rotate through different IP addresses using proxies or VPNs and continue making guesses. This means the rate limit appears to be tied to the attacker's location rather than the account being targeted.

There are also concerns that similar protections may not exist for password login attempts. 

Due to this negligence players that have followed all the security persuasions still suffer from getting their accounts taken away accounts that they have invested money and years into.

Animal Jam Classic players have time and time again emailed Animal Jam about these issues and we continue to be ignored.

We are asking Animal Jam to: 

1. Acknowledge the ongoing security concerns in Animal Jam Classic.
2. Provide a timeline for addressing these vulnerabilities.
3. Implement rate limiting and account lockouts based on the target account, not only the requester's IP address, for both 2FA verification attempts and password login attempts.
4. Require password resets for accounts whose credentials were exposed in the 2020 breach before allowing them to log in again, similar to how username moderation is enforced.
5. Improve monitoring and detection of distributed brute-force attacks originating from rotating IP addresses.

Animal Jam Classic players have been loyal for over a decade to the game, pouring their time and money into it. We deserve account security.

join the protest here:
https://discord.gg/WpU6XWc37