Roblox has experienced a data leak through third-party vendor FNTech, the online game platform confirms to PCMag.
"Roblox is aware of a third-party security issue where there was unauthorized access to limited personal information of a subset of our creator community," a Roblox spokesperson tells PCMag. "Our information security team quickly engaged the vendor to investigate and contain the issue. Those who were impacted have received an email communication."
Roblox previously declined to specify which vendor is associated with the breach, but later confirmed to PCMag that FNTech, a California-based events company that coordinates Roblox's annual conference, was the breached vendor. PCMag reached out to FNTech for comment.
The email Roblox sent to affected users says it was "recently notified [about] unauthorized access to a subset of Roblox user information from a 2022-20224 Roblox Developer Conference registration list via its website." It notes that registered names, email addresses, and IP addresses may have been viewed by the unknown actor.
Data breach tracking site Have I Been Pwned (HIBP), created by web security and IT professional Troy Hunt, reports that the data of over 10,300 Roblox conference registrants were leaked as a result of the breach on July 4. Roblox declined to confirm that number but denies that it's more than 10,000. The company pointed out that thousands of attendees do participate in its conference every year, however. Roblox's own systems have not been accessed or compromised, according to the company.
Unfortunately, this isn't the first time Roblox users have experienced a data breach. Information of nearly 4,000 Roblox Developer Conference attendees was reportedly exposed back in 2020. The data included birth dates, names, email addresses, physical addresses, IP addresses, and even T-shirt sizes. Roblox says this month's breach is unrelated to the 2020 incident.
HaveIBeenPwned added the 2020 breach to its records last year, and Roblox confirmed the 2020 breach in 2023 along with a statement and apology. Roblox offered some attendees from 2017 until 2020 a year's subscription to an identity protection service. It's unclear whether those impacted by this year's breach will receive the same offer.
If you're wondering whether your data might have been exposed online, there are free checks on sites like HIBP and MalwareBytes. You can also look into identity theft protection software options or credit monitoring services if you believe your identity or personal data is at risk.
Editor's Note: This story has been updated to include further comment from Roblox.