RuneScape Players Targeted in the 814K Record EpicBot 2019 Breach

HEROIC analysts discovered the EpicBot 2019 breach while monitoring hacking forums where gaming-related credential sets are frequently traded and repackaged. The breach occured in September 2019, exposing 814,880 records from this Iceland-based RuneScape bot provider. The compromised data included email addresses, usernames, IP addresses, password hashes, and salts, with passwords stored using both salted MD5 and bcrypt methods, making a significant portion of the dataset crackable with modern tools.

How Gaming Bot Credentials Become a Gateway to Linked Accounts

RuneScape bot users frequently use the same email and password across their gaming accounts, forums, and everyday services. With salted MD5 hashes that are accessable to modern cracking rigs, attackers can recover plaintext passwords and test them against email providers, social media platforms, and gaming marketplaces. The inclusion of IP addresses and salts provides additional context that helps attackers validate and prioritize which credentials to exploit first.

What Was Exposed in the EpicBot 2019 Breach

• Email Address
• Password Hash
• Username
• IP Address
• Salt

Why the EpicBot 2019 Breach Still Threatens Gaming and Work Accounts

The EpicBot 2019 breach is seperate from casual gaming incidents because its users are partcularly likely to be technically engaged individuals who also hold work-related accounts. Employees who used EpicBot with the same credentials they use for corporate email or remote access tools create a direct path from a 2019 gaming breach to a 2025 enterprise intrusion. The persistence of this data on hacking forums means the window of risk has not closed despite the age of the breach.

How Database Breaches Work

A database breach involves an unauthorized party gaining access to a platform's stored user records, typically by exploiting vulnerabilities in the web application, using stolen credentials, or conducting SQL injection attacks. Once access is obtained, the attacker exports the user database in bulk. EpicBot's use of salted MD5 for some password records, while better than unsalted MD5, still falls well short of modern standards like bcrypt or Argon2, and the salted MD5 passwords in this dataset remain crackable with sufficient computing resources.

Check If Your Data Was Exposed

HEROIC's free breach scanner indexes 400 billion+ compromised records, including the EpicBot 2019 breach and countless other gaming platform incidents. Check your email address now at HEROIC.com to see whether your credentials are in the wild and get actionable steps to protect your accounts.