Man arrested in toymaker hack that exposed 6M kids’ data

British police have arrested a 21-year-old man in connection with the hacking of the digital toymaker VTech that exposed data on 6.4 million children.

The South East Regional Organised Crime Unit (SEROCU) said in a statement Tuesday that it has arrested a man in Bracknell, a tech business hub west of London.

{mosads}“We are still at the early stages of the investigation and there is still much work to be done,” said Craig Jones, head of the SEROCU cyber unit.

No further details were provided.

The breach, revealed last month, exposed children’s names, gender and birthdates. Five million parent accounts were also exposed in the intrusion, compromising mailing and email addresses, security questions used for password resets, IP addresses, passwords and download histories.

Security experts who have reviewed the data say the stolen information on children can be linked with their parents’ data, thereby revealing the kids’ full addresses and other information.

The breach was first reported by Motherboard in November, who interviewed the hacker claiming responsibility for the theft.

At the time, he appeared to have only shared the information with Motherboard and said he was going to do “nothing” with the data, the publication reported.

“It was pretty easy to dump, so someone with darker motives could easily get it,” the hacker said.

Lawmakers in the U.S. have pressed the Hong Kong-based firm on how it collects and safeguards data.

“This breach raises a number of concerns,” wrote Sen. Ed Markey (D-Mass.) and Rep. Joe Barton (R-Texas) in a letter sent earlier this month.

Markey and Barton say the incident suggests problems with how VTech is complying with the Children’s Online Privacy Protection Act, the major federal law dictating how companies handle children’s digital data.

They have asked VTech to explain how it collected the data that was stolen, and what steps — such as encryption — it uses to protect it.

The lawmakers have requested a response by Jan. 8.