They start messing around with them, big time. There’s a whole online forum dedicated to hacking VTech tablets. People have done all sorts of things. One hacker even took the tablet apart and, with some tech magic, managed to get into the computer stuff inside, which is called Linux. From there, they could do all sorts of stuff. And get this, someone even got the toy tablet to play Doom, that old game from the 90s! The tech wizard community often says if you can’t open it, you don’t really own it. Just like it’s okay to tinker with your own car, it’s also okay to mess around with the gadgets you own. But as this forum got more popular, it attracted a different kind of hacker.

Instead of playing with hardware, this new hacker was all about networks. They poked around and found out the tablets chatted a lot with a website called planetvtech.com. They took a look and quickly found out the website had a big hole in its security, something called an SQL injection. Now, SQL injections are like the top risk for websites. They take advantage of weak spots in the website’s code to mess with the database underneath. These network hackers usually come ready with loads of programs to poke at websites. Out of curiosity, this hacker ran a quick program against planetvtech.com, trying to exploit the SQL thingy. And guess what? It worked! They got inside the website and, with a few taps on the keyboard, they got full control. They even said to themselves, “Wow, that was way too easy!”

Once they were in, they had a look around. They saw lots of other servers on the VTech network, including a big database server. They hopped into the database and found it was huge. They grabbed a copy of everything and then disconnected from the VTech servers.

But then, reality hit them. They realized they did something really bad. This happened around November 16, 2015. They were kinda disappointed but also kinda excited. They couldn’t believe how easy it was to get into VTech’s network and snatch up all that data.

With a copy of the VTech database on their computer, they slowly went through it. The first thing they saw was a list of parents. It had their names, emails, and home addresses. As they looked closer, they realized it was the entire user database for everyone who signed up on the site, about 4.8 million people! They were shocked.

A list like this could be worth a lot on the dark web, but this hacker didn’t want to sell it. They found another table with kids’ names, birthdays, and stuff. By combining these two tables, they could figure out where the kids lived. There were about 200,000 kids in this table, mostly around five years old. This made the hacker really mad. They thought VTech was way too sloppy with securing their site and kids’ info. They knew they had to do something about it.

So, they thought about it for a few days. They finally decided to spill the beans to the media. They reached out to Lorenzo Franceschi-Bicchierai, a reporter who was good at breaking stories about stuff like this. Lorenzo listened to what the hacker had to say and agreed to keep them anonymous. The hacker gave Lorenzo all the info they had and asked him to spread the word. They made it clear they weren’t in it for the money; they just wanted VTech to fix their mess. Lorenzo checked everything and found it was legit. He published the story, and it spread like wildfire.

VTech got in a lot of trouble. Parents were angry, and their stock dropped. But VTech tried to make things right. They fixed some security issues and promised to do better in the future. Eventually, things calmed down, and VTech went back to selling toys. But the story doesn’t end there.

A year later, the hacker’s identity was still a mystery. They had only received a slap on the wrist from the cops. Nobody knew if they were still in jail or walking free. But one thing’s for sure, this hacker may have broken the law, but they did it to protect kids’ privacy, and that’s something to think about.