Welcome to Jellyneo.net!

UPDATE, 5:30 PM NST: Forced password updates have returned. If you haven't reset your password today, you'll be forced to do so before logging in.

Note that MANY Neopians are having issues with password resets (there's numerous problems with the Neopets authentication system). If you're one of them, it's okay! Don't panic too much. We recommend (a) trying again in an hour or so, and if that doesn't work, (b) filing a ticket with Neopets Support. They've been quite responsive in recent months, so it's very likely you'll get a timely response.

If you are able to get through the password reset process, see our red WARNINGS below, as there are many restrictions on what you can use for your password. If you don't heed these warnings, you'll be locked out of your account.

---

UPDATE, 4:00 PM NST: Forced password updates have been paused. No official announcement by TNT yet, so it's unknown why they paused the forced resets, or if they'll bring them back. If you haven't visited Neopets yet today, you won't need to reset your password to get in. If you already tried resetting (and ran into issues), give your old password a shot.

---

In response to the recent site breach, all accounts were logged out of Neopets.com earlier this afternoon and all passwords were invalidated by TNT.

To gain access to your account again, you'll need to go through the password reset process, available at: https://www.neopets.com/account/passwordreset.phtml


As you'd expect, the reset process involves an email being sent to your account's associated email address with a special link to click. Upon clicking the link, you'll be asked to set a new password.


The password change form will also nag you about having at least 2 numbers in your password—even if you have 2 or more numbers in the new password. Ignore that, it'll let you submit anyway even if it doesn't recognize all your numbers.

We've seen a few reports of users being locked out of their account after resetting their passwords, and being asked to reset their password again. TNT is aware of this, but we at Jellyneo would recommend that you file a ticket with support if you can't get into your account within the next 24 hours. Password resets should reset periodically, so you may be able to try again shortly.

A statement about the breach was also posted on Twitter:

Neopians:

We wanted to take a moment to provide you with an update since our update on July 20th.

As we previously communicated, Neopets was alerted on July 20th to activity indicating unauthorized access by a third party to portions of our IT systems. Upon investigation, we took immediate steps to shut down further access to the affected systems and we have not seen any unauthorized activity since that time.

We reported the event to law enforcement, and began working with external cybersecurity experts to investigate the event and determine what happened and what data was impacted. As a matter of course, we do not collect or store payment information and do not have evidence that it was impacted. Once the investigation has concluded, we will share additional information, as appropriate.

Our team is working around the clock, deploying additional safeguards onto our systems, including enhancing monitoring of our systems, reinforcing our security practices, and actively reviewing systems to enhance security controls and all security protocols. As a reminder, neither Neopets or its employees will ever ask for your login information. As a precaution, we are taking steps to protect users’ accounts, so when you next visit Neopets, you will be prompted to change your password. We are also currently working on adding multi-factor authentication to better safeguard your account access.

We appreciate your understanding and patience during this event and are committed to supporting the Neopets community. We invite you to reach out to us through our normal support channels with any questions or concerns you might have regarding this incident or the security of your account.

One important aspect of the statement above is the confirmation that payment information (for Neocash or Premium subscriptions) was not included in the breach.