Runescape Backstreet Merch

We noticed a significant data leak originating from a vendor servicing the Runescape gaming community. The discovery on November 8th, 2020, involved a dataset containing over 155,000 records, a substantial figure for a niche e-commerce platform. What struck us immediately was the inclusion of plaintext passwords alongside email addresses, a critical security oversight that amplifies the risk to affected users. The data's subsequent appearance on a prominent cybercrime forum indicates a deliberate dissemination, suggesting potential for further exploitation beyond simple credential stuffing.

The incident at Runescape Backstreet Merch, a UK-based e-commerce platform specializing in official Runescape merchandise, exposed 155,974 records. This breach, discovered on November 8th, 2020, primarily involved the compromise of user email addresses and, alarmingly, their associated passwords stored in plaintext. The source structure appears to be a direct database dump, later packaged into a combolist format for easier distribution on cybercrime forums. The exposure of plaintext credentials significantly increases the risk of account takeover for affected users, potentially impacting not only their Runescape accounts but any other services where these credentials might be reused. The data types compromised are limited to PII (email) and authentication credentials, but the unencrypted nature of the passwords elevates the severity.

While this specific breach may not have garnered widespread mainstream media attention, it aligns with a persistent trend of smaller, specialized e-commerce sites becoming targets. Such incidents often fly under the radar of major cybersecurity news outlets but represent a tangible threat to their user bases. The methodology—a database compromise leading to a combolist—is a common tactic observed in numerous breaches targeting online retailers and community-driven platforms. Further investigation into the specific forum where the data was shared could provide insights into the threat actor's motives and potential future targets within similar communities.