Adopt Me Trading Values Website Breach Exposes 86,136 User Credentials
What Happened — In July 2022 the Adopt Me Trading Values website, a tool used by Roblox players to assess pet‑trade values, suffered a data breach. Attackers accessed the site’s user database and later redistributed the data as part of a larger public corpus. The breach exposed 86,136 unique email addresses, usernames (including Roblox handles), IP addresses and bcrypt password hashes.
Why It Matters for Trust & Control Assurance —
- The incident underscores the risk of weak credential‑protection controls and the need for continuous monitoring of authentication assets.
- It illustrates why a defensible audit trail of password‑policy enforcement, hashing standards, and access‑control reviews is essential for a control‑assurance program.
- It demonstrates the value of a unified platform that can surface credential‑exposure evidence to satisfy multiple framework objectives with a single control objective.
Who Is Affected — Online gaming platforms, virtual‑economy services, and any web‑based application that stores user credentials.
Recommended Actions —
- Verify that all stored passwords use a strong, adaptive hashing algorithm (e.g., bcrypt with an appropriate cost factor).
- Deploy continuous credential‑exposure monitoring and trigger forced password resets for any compromised accounts.
- Document the incident‑response steps and update access‑control policies to reflect lessons learned.
Source: [Have I Been Pwned – Adopt Me Trading Values breach]
Technical Notes — The breach appears to stem from unauthorized access to the site’s backend database; no specific CVE is cited. Exfiltrated data includes email addresses, usernames, IP addresses and bcrypt password hashes, which could be cracked offline given sufficient resources. Source: [HIBP API]