US Congress asks VTech to explain privacy breach

US lawmakers have asked toymaker VTech to explain why it collects data on children and how it secures that data, following an attack that exposed the records of 6.4 million customers. 

In a letter, two leaders of a congressional group focused on privacy asked VTech for specific information on what data it collects on children aged 12 and younger, how it uses the information, and whether it shares or sells such data to third parties. 

"This breach raises several questions about what information VTech collects on children, how that data is protected, and how VTech complies with the Children's Online Privacy Protection Act," Democratic senator Edward Markey and Republican representative Joe Barton said in the letter. 

The request referred to a 1998 law designed to enable parents to protect their children's privacy. 

The letter also asks for details about what sort of encryption VTech's products use, what steps it is taking to prevent future breaches, and how affected customers have been notified of the breach. 

The toymaker was given until January 8 to respond to the letter. 

Representatives for Hong Kong-based VTech could not be reached for comment on the matter. 

The request was made after VTech disclosed earlier this week that a breach compromised data on 6.4 million children and 4.9 million adults, in the largest known cyber attack targeting children's data. 

The incident raises questions about the company's adherence to the law and steps it had taken to protect children's personal information, according to Markey and Barton.

The company has admitted it was at fault. 

"Regretfully, our database was not as secure as it should have been," VTech said in a detailed document on the breach published on its website. 

Security experts and one equity analyst said the company could face government inquiries and private lawsuits from customers worldwide. 

"Ninety percent of VTech's revenue comes from developed markets where consumer protection policies are more stringent," said Warren Lau, an analyst for Maybank KimEng Securities. 

"It comes at an unfortunate time as well, a few weeks away from Christmas." 

VTech shares have fallen 2.73 percent since it first revealed the hack on November 27, while the Hang Seng index was down 0.38 percent during the same period.