The hacker says he's carved 2.2m passwords out of i-Dressup and could easily get at the entire database of 5.5m.