Roll20 Data Breach (2018): What Was Exposed & What To Do

In December 2018, the tabletop role-playing platform Roll20 reported a data breach that affected nearly four million user accounts. The incident exposed email addresses, IP addresses, names, bcrypt password hashes, and the last four digits of credit card numbers. For people who maintained accounts on the service, the exposure created lasting questions about how their information might be used elsewhere.

Inside the incident

The breach was made public on December 26, 2018. Company statements at the time indicated that almost four million customers had their email addresses, IP addresses, names, bcrypt hashes of passwords, and the final four digits of credit card numbers accessed without authorization. No further technical details about the method of access or the duration of the intrusion were released in the initial disclosure. The exact date when the data was first taken also remained undisclosed.

How a breach like this happens

Incidents involving large volumes of user records often begin with an attacker obtaining access to a web application’s database or backup storage. This can occur through stolen administrative credentials, an unpatched server vulnerability, or misconfigured access controls that allow external parties to read files they should not reach. Once inside, an attacker can copy tables containing account details and authentication data. Passwords stored as bcrypt hashes require significant computational effort to reverse, yet the presence of any hashed credentials still increases the chance that some accounts can be compromised if users have reused those passwords on other sites.

Who is Roll20?

Roll20 operates an online service that hosts virtual tabletops for role-playing games. Users create accounts to play with others, store character sheets, and manage game sessions. Organizations of this type routinely collect contact information, payment details for subscriptions, and technical identifiers such as IP addresses to support account recovery and fraud prevention. A breach at a platform that stores both identity data and partial payment information therefore touches both personal privacy and financial identifiers.

What data was at risk

The reported exposure included email addresses, IP addresses, names, bcrypt hashes of passwords, and the last four digits of credit card numbers. Full card numbers, expiration dates, and CVV codes were not listed among the exposed elements. Organizations in this sector commonly hold additional fields such as billing addresses or transaction histories, yet the precise scope of records accessed in this case was not further detailed beyond the categories already named.

The real-world impact

Individuals whose email addresses and password hashes were exposed face an elevated risk that attackers will attempt to reuse those credentials on other services. The combination of names and partial card data can also support targeted phishing or account-takeover attempts that reference real transaction history. For the organization, the incident required notification to millions of users and likely prompted reviews of authentication storage and access logging practices. No public statements quantified direct financial costs or regulatory penalties tied to the event.

Were you affected?

Users who created a Roll20 account before the end of 2018 should assume their listed information may have been included. Practical steps include changing the password on that account and any other service where the same password was used, enabling multi-factor authentication where available, and monitoring statements or alerts from financial institutions for unusual activity involving the last four digits of the card. Readers can also submit their email address to a free public breach-exposure scanner to check whether the address appears in this or other known data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.