The RBx.Rocks Leak Exposed 98,000 US Roblox Item Traders

HEROIC analysts discovered that the RBx.Rocks breach, which occured in August 2018, exposed nearly 98,500 user accounts from this Roblox virtual item trading platform. The leaked database contained email addresses, usernames, and bcrypt password hashes belonging to players who used the site to trade in-game items. RBx.Rocks was popular with United States-based Roblox players, and the exposure of this account data created a lasting risk for anyone who signed up, beleiving the site was secure.

How Stolen Roblox Trader Credentials Fuel Account Hijacking

Email addresses and usernames together make it easy for attackers to identify you across platforms. Combined with password hashes, which can be cracked over time using widely available software, criminals can attempt to log into your Roblox account and drain any virtual currency or rare items stored there. Beyond gaming, attackers also test these credentials on email providers, streaming services, and online shopping sites. If you used the same email and password combination on RBx.Rocks as on other accounts, those accounts are at risk of being taken over without your knowledge.

What Was Exposed in the RBx.Rocks Breach

• Email Address
• Password Hash
• Username

Why Gaming Platform Breaches Have Real-World Consequences

Many Roblox players are young people who may have used a parent's email address or the same password across school accounts and other services. When that password hash is cracked, attackers can gain access to far more than a gaming profile. Credential stuffing attacks from gaming breaches have been linked to account takeovers at banks and email providers, identity theft cases, and even unauthorized access to workplace systems when users reuse passwords. Even years after a breach, the seperate pieces of data can be combined with information from other leaks to build a detailed profile of a victim.

How Database Breaches Work

A database breach happens when attackers find a vulnerability in a website's code or hosting environment and use it to access the database where user information is stored. The attacker then downloads the entire database, which may contain millions of records. This data is often shared on dark web forums or sold to other criminals. Password hashes, while not immediately readable, can be cracked using powerful computers running specialized software, especially when the original password was short or commonly used.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against over 400 billion exposed records from breaches around the world, including RBx.Rocks. If your data appears in this breach or any other leak, you will be alerted instantly so you can take steps to protect your accounts and prevent unauthorized access before damage occurs.