EpicBot Data Breach (2019): What Was Exposed & What To Do

In September 2019, a data breach at EpicBot exposed records belonging to 817,000 subscribers. The material later appeared on a hacking forum and contained usernames, email addresses, IP addresses, and passwords stored as salted MD5 or bcrypt hashes. EpicBot did not respond to contact about the incident. The event is significant for users who registered with the service because the exposed data can be used for targeted account access attempts and further reconnaissance. Email addresses combined with IP records allow correlation across other services, while hashed passwords require offline cracking before they can be misused.

Breaking down the breach

The incident was reported on 1 September 2019. It affected 817,000 subscribers of the RuneScape bot provider EpicBot. The data set that surfaced included usernames, email addresses, IP addresses, and passwords stored as salted MD5 or bcrypt hashes. No further technical details about the intrusion method, the exact date of the compromise, or the volume of records initially taken have been made public. EpicBot has not issued a statement confirming or disputing the claims.

How a breach like this happens

Incidents involving online service providers often begin with the compromise of a web application, database server, or third-party integration. Attackers may exploit unpatched software, weak authentication controls, or stolen administrative credentials to reach user tables. Once inside, they copy authentication data and associated profile fields. The stolen material is sometimes posted or sold on forums, where other actors can attempt to crack password hashes or match the records against accounts on unrelated platforms.

Who is EpicBot?

EpicBot operated as a provider of automation tools for the online game RuneScape. Services of this type maintain accounts that link game credentials or payment details to user identities, allowing subscribers to manage bot configurations and access. Because the platform handled login information and contact details, a breach directly implicates the personal data of its user base rather than only in-game characters.

The information in question

The records reported as exposed are usernames, email addresses, IP addresses, and passwords stored as salted MD5 or bcrypt hashes. The exact scope of additional fields, such as payment information or full names, has not been disclosed. Organisations that provide game-automation services commonly store email addresses for account recovery, IP addresses for abuse prevention, and password hashes for authentication; however, the precise contents of the EpicBot data set remain unconfirmed beyond the four categories already noted.

What's at stake

For individuals, the primary risks are credential-stuffing attempts on other sites where the same email and password combination may have been reused, and the potential for targeted phishing that references the RuneScape-related account. IP addresses can assist in geographic profiling or further correlation of online activity. For the organisation, the incident highlights the long-term consequences of retaining authentication data without documented response or remediation steps.

Were you affected?

Individuals can check whether their email address appears in known breach data sets by using a free exposure scan offered by services that aggregate public breach records. If matches are found, the immediate steps are to change passwords on the affected account and any other site using the same credentials, and to enable multi-factor authentication where available. Monitoring for unusual login attempts on linked email and game accounts is also advisable.

AICompiled with AI assistance from public sources and published under our editorial standards.