Roblox roblox.com Roblox data breach: what happened and what to do
In 2016, a Roblox test server left the details of 52,458 accounts exposed: email addresses, IP addresses, usernames, purchases and Robux balances. Roblox disclosed it in August 2016. Passwords were not part of the exposed data, so phishing is the main risk.
View all 13,115 breaches- Breach date
- 31 Jul 2016
- Affected
- 52,458
- Data exposed
- Account balances, Email addresses, IP addresses, Purchases, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Roblox disclosed a security incident in August 2016. Data from a test server had been left exposed, and it covered 52,458 accounts. The breach itself dates to the end of July 2016. Have I Been Pwned (HIBP), the breach notification service, added it to its database in July 2023, which is when many people first saw their email address listed.
The numbers are small next to the billions of records in the biggest leaks, but the accounts belong to a platform where a large share of players are children and teenagers. That matters for what comes next.
What was exposed
HIBP lists five kinds of data:
- Email addresses
- IP addresses
- Usernames
- Purchases
- Account balances (Robux, the in-game currency)
Passwords are not on the list. That is the good news: nobody got into accounts straight from this leak.
What criminals can do with it
An email address plus a username and a purchase history is enough to write a believable message. A scam email can say "your Robux purchase of 800 Robux didn't go through" and be right about the username. Scams aimed at young players often promise free Robux in exchange for a login, and a real username makes them more convincing.
IP addresses give a rough location, usually the city or region of the internet provider. They are not a street address, but they can be paired with other leaked data to build a profile.
The exposed Robux balances show which accounts held a lot of in-game currency, which is the kind of detail an account thief would care about.
What Roblox did
Roblox disclosed the incident in August 2016 and the data was published as a test-server exposure. The sources describe an exposure on a test system, not an attack on the live password database.
If your email is listed
Because the breach is old, the risk today is mostly spam and phishing rather than account takeover. Still, check the account: look at recent logins and linked email addresses, and turn on 2-step verification. If the same email and password combination was used on other sites, change those too. Reused passwords cause far more damage than a leak of an email address on its own.
How to tell a real message from a scam
Roblox only contacts you through the email address on your account and in-app notices. A message that pushes you to log in through a link, asks for a 2-step code, or offers free Robux is not from Roblox. If you're unsure, close the message, open the Roblox app or type roblox.com yourself, and look for the same notice there. If it isn't there, it wasn't real.
Parents can add an account PIN and check which email address is on a child's account. If that email is one you no longer read, change it, so recovery messages don't go to a stranger.
What to do if you were in it
- 1
Check the account's security settings
Log in to Roblox, open Settings and Security, and review the email address and the active sessions. Turn on 2-step verification if it is off.
- 2
Change the password if you reuse it
Roblox passwords were not in this leak, but if you use the same password anywhere else, change it there. Use a password manager so each site gets its own.
- 3
Treat Robux and 'free item' messages as scams
Messages that quote your username or a recent purchase can be real-looking. Don't click links in them. Go to roblox.com yourself, and never share your login or a 2-step code.
- 4
Talk to younger players
If a child plays, explain that no one from Roblox will ask for a password in a message, and that a stranger offering free currency is after the account.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which other breaches include your email or phone, and get alerted when it shows up in a new one.
Frequently asked
Was I affected by the Roblox data breach?
If your email address was one of the 52,458 in the 2016 test-server exposure, yes. You can look up your email on Have I Been Pwned, or run a free Serus scan.
Were Roblox passwords leaked?
No. The exposed data was email addresses, IP addresses, usernames, purchases and Robux balances. Passwords are not listed.
Should I change my Roblox password?
It is a good idea if you haven't changed it since 2016, or if you use it anywhere else. Turn on 2-step verification too.
Is this the same as the 2023 Roblox developer conference leak?
No. This page is about the 2016 incident. Other Roblox security incidents are separate events.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
