Divine Skins Data Breach (2026): What Was Exposed & What To Do

On March 13, 2026, Divine Skins disclosed a data breach that affected 106,000 users of its League of Legends custom skins service. An unauthorised third party accessed part of the company’s systems, deleted all skins from the database, and exposed email addresses, usernames, and records of user purchases. The company announced the incident through its Discord server. The event adds to the steady stream of incidents involving online platforms that store customer account and transaction details. Public records of the breach remain limited to the company’s statement, with no further technical details released at the time of reporting.

Inside the incident

Divine Skins stated that the intrusion occurred in March 2026. The unauthorised party gained access to part of the service’s systems, removed the entire collection of custom skins from the database, and made email addresses, usernames, and purchase histories available. The disclosure was posted on the company’s Discord server on March 13, 2026. No information has been published about the method of entry, the duration of access, or whether additional data was taken.

How a breach like this happens

Incidents involving unauthorised access to online service databases often begin with the exploitation of remote access points, weak authentication controls, or unpatched software components. Once inside, an attacker may locate customer records stored for account management and transaction processing. In some cases the intruder also alters or deletes files as part of the activity. Public reporting on any single event rarely includes the precise sequence until forensic findings are shared by the affected organisation.

About Divine Skins

Divine Skins operates a service that supplies custom skins for the game League of Legends. Users register accounts, select items, and complete purchases through the platform. Companies of this type routinely maintain records that link an individual’s contact information to their transaction history and chosen username. A breach at such a service therefore touches both personal identifiers and evidence of commercial activity.

The information in question

The company’s statement lists three categories of data as exposed: email addresses, usernames, and purchase histories. It is not known whether additional fields, such as passwords, payment card details, or full names, were present in the accessed portion of the database. Organisations in this sector commonly store the data types named in the disclosure, yet the precise contents of the exposed records remain unconfirmed beyond the published summary.

What's at stake

Exposed email addresses and usernames can be used to craft targeted messages that appear to come from the service or related platforms. Purchase records may reveal patterns of spending that could be referenced in follow-on attempts to gain further information. For the organisation, the deletion of its skin database represents an immediate operational loss, while the exposure of customer records creates longer-term obligations around notification and account security. The scale of 106,000 affected users means these issues apply across a sizable group rather than isolated individuals.

If your data was in this breach

Individuals who used Divine Skins should review the email account associated with the service for any unexpected messages and consider changing the password on that account as well as any other service where the same credentials may have been reused. Enabling multi-factor authentication where available adds a further control. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information appears in this or other publicly documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.