Let’s kick off the holiday shopping season with news of a data breach that may involve some toys you’ll be wrapping in the coming weeks. Popular children’s electric toy maker VTech has announced that customer information fell into the wrong hands earlier this month. 

VTech announced Friday that on Nov. 14, an “unauthorized party” accessed customer data housed in its Learning Lodge app store, which allows customers to download apps, games, e-books and other content for VTech products.

While the company assured users that the Learning Lodge does not store credit card information or Social Security numbers, the database does include data like names, e-mail addresses, encrypted passwords, IP addresses, mailing addresses, download histories, and answers to password-retrieval questions.

“Upon discovering the unauthorized access we immediately conducted a thorough investigation, which involved a comprehensive check of the affected site and implementation of measures to defend against any further attacks,” VTech said in a statement.

The company didn’t specify how many users may have been affected by the breach, but it currently provides services to people in the U.S., Canada, the UK, Ireland, France, Germany, Spain, Belgium, the Netherlands, Denmark, Luxembourg, Latin America, Hong Kong, China, Australia, and New Zealand.

Motherboard reports that the compromised information may include data for nearly 5 million adults who have purchased VTech products and the first names, genders, and birthdays of more than 200,000 children.

“The investigation continues as we look at additional ways to strengthen our Learning Lodge database security,” said VTech. “We are committed to protecting our customer information and their privacy, to ensure against any such incidents in the future. Our Privacy Statement can be found on our website here.”

[via Motherboard]

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.