Researchers Link the EpicBot Leak to 34,581 Stolen Gaming Credentials

HEROIC analysts identified a database leak tied to EpicBot (epicbot.com), a gaming automation service built around RuneScape botting. The breach is dated February 5, 2016, and exposed 34,581 records, including email addresses, usernames, passwords, IP addresses, and the hash type used to protect them.

Why the EpicBot Leak Is Still Dangerous

Gaming utility services rarely get the security attention of major platforms, but the accounts behind them hold the same real credentials as anywhere else. With IP addresses included alongside emails and passwords, this dataset gives attackers more than just a login to try. It can help them tie an account to a general location or link the same person across other services where they used a similar username.

What Was Exposed in the EpicBot Database

• Email addresses
• Usernames
• Passwords (vBulletin hash format)
• IP addresses
• Hash type metadata

Why This Matters for Former EpicBot Users

EpicBot itself is no longer an active service, but that doesn't make this data harmless. People who signed up for gaming tools years ago frequently used the same email and password combination they still rely on today. Attackers running credential stuffing campaigns don't care how old a password is, only whether it still works somewhere. A matching username and password from 2016 can unlock a current account just as easily as a fresh leak can.

How This vBulletin Database Breach Happened

This incident is classified as a database breach and involves passwords hashed with vBulletin's format, a forum software package widely used to run gaming and hobbyist communities. Sites built on vBulletin have historically been targeted through unpatched vulnerabilities or outdated plugin code, giving attackers a path to copy the entire user table, hashed passwords included, straight out of the database. From there, weaker hashes can be cracked and turned into plaintext passwords over time.

Check If You Are Affected

If you ever created an account with a gaming utility or botting service, it's worth finding out whether that email shows up in a leak like this one. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, so you can see your exposure and change any passwords you're still using elsewhere.