It’s the biggest ever cyber attack targeting children: about 6.4 million kids in the United States and Hong Kong have had their personal information released thanks to a hack at toymaker VTech.

In addition, the thieves stole personal information from 4.9 million parents, including photos and addresses, according to a Guardian report.

VTech is now under investigation after the hack released huge volumes of details, with attorneys general in the states of Connecticut and Illinois pledging to look into the breach.

VTech is based in Hong Kong and produces electronics for children. These kids’ computers can download games through the company’s portal, and it was by hacking this that hackers were able to steal personal information like a consumer database, chat logs, and photos.

The personal information was not encrypted and gave the criminals access to names, passwords, email addresses, physical addresses, download histories, and other information.

In addition to the U.S. states, Hong Kong Privacy Commissioner Stephen Wong said his office was conducting a compliance check on VTech to determine if data privacy principles were followed. It could lead to greater scrutiny and more regulations for toymakers. Toymakers are not known for their encryption and security abilities, especially compared to other companies like financial and electronics firms that must have significant safeguards in place.

It goes to show that no company is safe, particularly those that keep any data on their customers. The recent hack of infideltiy website Ashley Madison exposed a huge database of names, and this hack of VTech shows that hackers will target any company that is vulnerable. It can result in the release of credit card and other personal information.