EpicBot Data Breach Exposes 816,662 User Accounts
What Happened — In September 2019 the RuneScape bot service EpicBot suffered a breach that released data for roughly 817 k subscribers. The leaked dump, posted on a public hacking forum, contained usernames, email addresses, IP addresses and password hashes (salted MD5 or bcrypt). EpicBot did not respond to inquiries about the incident.
Why It Matters for Trust & Control Assurance
- Storing passwords with weak or legacy hashing (e.g., salted MD5) violates best‑practice credential protection controls that a continuous‑control‑assurance program must monitor.
- The exposure of a third‑party service’s user database illustrates the need for ongoing vendor‑risk oversight and evidence‑based assurance that suppliers meet your security requirements.
- Documented breach response and evidence collection are essential for a defensible audit trail when regulators or partners request proof of due diligence.
Who Is Affected — Gaming‑related SaaS providers, online bot services, and any organization whose users also rely on EpicBot for RuneScape automation.
Recommended Actions
- Review and upgrade password‑storage policies (use strong, adaptive hashing such as Argon2).
- Conduct a third‑party risk assessment of EpicBot and any similar service, capturing evidence of their security controls.
- Update incident‑response playbooks to include notification and evidence‑preservation steps for supplier‑originated breaches.
- Continuously monitor vendor security posture through automated assurance tooling. Source: https://haveibeenpwned.com/api/v3/breach/EpicBot
Technical Notes
- Attack vector not publicly disclosed; breach appears to stem from unauthorized access to EpicBot’s user database.
- Exposed data types: email addresses, IP addresses, usernames, password hashes (salted MD5, bcrypt). Source: https://haveibeenpwned.com/api/v3/breach/EpicBot