Roll20 Data Breach Exposes 3.1M Tabletop Gaming Player Records

HEROIC's DarkHive system discovered the Roll20 breach, exposing 3,092,445 records in December 2018. This US-based tabletop role-playing game platform suffered a database compromise that revealed email addresses, first and last names, and bcrypt password hashes belonging to millions of players and game masters who used this virtual tabletop gaming service.

Why This Is Dangerous

Roll20 serves a highly engaged user community who share personal game session data, chat histories, and campaign materials within the platform. The exposure of nearly 3.1 million records means a large cross-section of the tabletop gaming community had their credentials compromised. While bcrypt hashing provides better protection than weaker algorithms, attackers with sufficient computing power can still crack these hashes, particularly for users who chose weak or commonly used passwords.

What Was Exposed

• Email Address
• First Name
• Last Name
• Password Hash (bcrypt)

Why This Matters

With over 3 million affected accounts, this breach represents a significant source of credentials for automated stuffing attacks targeting other online services. Users who registered on Roll20 with the same email and password combination used on other platforms face ongoing risk of account takeover. Full names paired with email addresses also support phishing campaigns and social engineering attacks targeting affected individuals.

How Database Breach Works

Gaming platform databases are targeted because of the personal and payment data they store and the large, engaged user bases they serve. Attackers exploit vulnerabilities in web applications, outdated server software, or weak administrative credentials to access underlying databases. Once extracted, the records are sold or distributed on underground forums where they are incorporated into credential stuffing tools and identity fraud operations.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the Roll20 breach. Visit heroic.com to check if your information was exposed.