Roll20 roll20.net Roll20 data breach: what happened and what to do
Around December 26, 2018, tabletop gaming site Roll20 had a data breach that exposed almost 4 million accounts: names, email addresses, IP addresses, password hashes and the last 4 digits of credit cards. Roll20 said no financial data was included.
View all 13,115 breaches- Breach date
- 26 Dec 2018
- Affected
- 3,994,436
- Data exposed
- Email addresses, IP addresses, Names, Partial credit card data, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Roll20, the tabletop role-playing games website, was named in a February 2019 report as one of several victims of a cybercriminal attack. On February 14, 2019, it posted a notice about the incident. A day later it updated that notice to say the breach took place on approximately December 26, 2018, judging by the account numbers in the breached data.
Have I Been Pwned lists 3,994,436 affected accounts. The exposed data includes email addresses, IP addresses, names, bcrypt password hashes and the last 4 digits of credit cards. Roll20 said the stored data covered name, email address, hashed password, last login IP and login time, and the last 4 digits of card numbers, and that no financial data was included. It logged everyone out of the site to clear possible session cookies, worked with outside investigators and notified law enforcement.
Four card digits alone can't be used to pay for anything, but they make a phishing email that claims to be from a bank or Roll20 more convincing. Email addresses and names are what scammers need to send you a believable message, and IP addresses give a rough idea of where you live.
What to do if you were in it
- 1
Change your Roll20 password and any copy of it
If you reuse the Roll20 password anywhere, change it there too, starting with email and banking. Use a unique password for each account and turn on two-factor authentication where it's offered.
- 2
Treat unexpected emails and texts with suspicion
Criminals use breach details to make scam messages sound real. If a message mentions the breach or asks you to log in, click a link or share a code, go to the company's site yourself instead.
- 3
Check your card statements
Only the last 4 digits were exposed, but scan your statements anyway and report charges you don't recognize to your card issuer.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in breach databases and the dark web and tells you what to do about each hit. Serus can't pull breach data back, but it alerts you when your details turn up.
Frequently asked
Was I affected by the Roll20 breach?
Almost 4 million accounts were affected, according to Have I Been Pwned. Search your email there or run a free Serus scan to see.
What was exposed in the Roll20 breach?
Names, email addresses, IP addresses, bcrypt password hashes and the last 4 digits of credit cards. Roll20 said no financial data was included.
Should I change my password?
Yes, on Roll20 and on any site where you reused it. Turn on two-factor authentication where you can.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
