Roll20 Data Breach Exposes Nearly 4 Million User Accounts
What Happened — In December 2018 the online tabletop‑gaming platform Roll20 suffered a data breach that exposed the personal information of 3,994,436 registered users. The compromised data set includes email addresses, IP addresses, full names, bcrypt password hashes and the last four digits of credit‑card numbers.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate credential protection and weak access‑control safeguards—exactly the scenario a continuous control‑assurance program is built to detect and remediate.
- Demonstrating defensible evidence of strong password‑storage practices (e.g., salted hashing, regular rotation) and multi‑factor authentication is a core control that maps to many frameworks (NIST CSF 2.0, ISO 27001, etc.).
- Continuous monitoring of authentication logs and third‑party vendor security posture provides the audit trail needed to prove due diligence after a breach.
Who Is Affected
- Online gaming and hobbyist SaaS providers
- Any organization that stores user credentials and partial payment data in a web‑based service
Recommended Actions
- Force password resets for all affected accounts and enforce MFA where possible.
- Review and upgrade password‑hashing algorithms; ensure salts are unique per user.
- Conduct a gap analysis against the “identity and access management” control area and collect evidence for audit readiness.
- Monitor for credential‑stuffing attacks against other services where users may have reused passwords.
Source: Have I Been Pwned – Roll20 breach
Technical Notes
- Attack vector not publicly disclosed; breach appears to involve unauthorized access to the user database.
- Exposed data types: email, IP address, name, bcrypt password hash, last‑4 digits of credit cards.
Source: HIBP breach details