EpicBot epicbot.com EpicBot data breach: what happened and what to do
EpicBot, a RuneScape bot provider, was breached in September 2019. About 817,000 subscribers had usernames, email addresses, IP addresses and hashed passwords exposed. EpicBot did not respond to HIBP.
View all 13,115 breaches- Breach date
- Sept 2019
- Affected
- 816,662
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
EpicBot sells bot software that automates actions in the game RuneScape. In September 2019 its subscriber database was breached, and the data was later shared on a hacking forum. Have I Been Pwned (HIBP) counts 816,662 affected accounts.
What was exposed
Each record has a username, an email address, an IP address and a password. The passwords were stored as hashes, either salted MD5 or bcrypt. Bcrypt is slow to crack on purpose. MD5 is old and fast, so passwords protected by it are far easier to recover.
What it lets criminals do
People who used a bot service often reuse a gaming password elsewhere. Criminals take the email and recovered password and try them on game accounts, email and shops, a method called credential stuffing. Your IP address also hints at your rough location, and the email address makes you a target for phishing that mentions RuneScape or account bans.
The company's response
HIBP reports that EpicBot did not respond when contacted about the incident. Press coverage at the time reported the same leak, along with a separate one from a currency exchange, but no public statement from EpicBot.
What to do
Treat any password you used on EpicBot as public. Change it wherever it is still in use, and check your RuneScape account for logins you don't recognise.
What to do if you were in it
- 1
Change your EpicBot password
Go to the account settings and pick a new password. If the site is gone or you no longer use it, you can skip this step. If you used the same password for RuneScape, change that first and check the account's recent activity.
- 2
Change it everywhere you reused it
Look through your password manager or browser for logins that share the old password and replace each one, starting with email, banking and shopping accounts. Use a different password for every site.
- 3
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email and any account that holds money or personal details. A stolen password alone then isn't enough to get in.
- 4
Expect phishing that uses your email address
Treat unexpected messages about your account, a prize or a password reset with suspicion. Don't click links in them: type the site address yourself or use its app.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the EpicBot breach?
If you subscribed to EpicBot, possibly. Search your email address on HIBP to see whether it is in the data.
What was exposed in the EpicBot breach?
Usernames, email addresses, IP addresses and passwords stored as salted MD5 or bcrypt hashes.
Did EpicBot respond to the breach?
HIBP says EpicBot did not respond when contacted about it.
Should I change my password after the EpicBot breach?
Yes, on any site where you used the same password. Use a unique password for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
