--- title: Conclusion of 2018 Data Breach Investigation description: In February of this year we became aware of information claiming to be from the Roll20 “accounts table” being placed for sale on a dark web marketplace for $208; an amount less than comparable data sets. image: https://bloghub.roll20.net/hubfs/blog-featured-placeholder%20(3).jpg --- [![](https://bloghub.roll20.net/hubfs/Roll20%20-%20Assets/Blog/Group%202.svg)](https://roll20.net/) - [Blog](https://bloghub.roll20.net/roll20-blog) - [Marketplace](https://marketplace.roll20.net/) - [Community](https://app.roll20.net/forum/) ![](https://bloghub.roll20.net/hubfs/Roll20%20-%20Assets/Icon%20Copy.svg) [Play Now](https://app.roll20.net/) News # Conclusion of 2018 Data Breach Investigation August 12, 2019 ![roll20](https://bloghub.roll20.net/hubfs/blog-featured-placeholder%20(3).jpg) SHARE: [Share this blog post on Facebook](http://www.facebook.com/share.php?u=https://bloghub.roll20.net/posts/conclusion-of-2018-data-breach-investigation/) [Share this blog post on Twitter](https://twitter.com/intent/tweet?url=https://bloghub.roll20.net/posts/conclusion-of-2018-data-breach-investigation/&text=Conclusion%20of%202018%20Data%20Breach%20Investigation) [Share this blog post on Reddit](https://reddit.com/submit?url=https://bloghub.roll20.net/posts/conclusion-of-2018-data-breach-investigation/) ![The Roll20 Team](https://bloghub.roll20.net/hs-fs/hubfs/roll20team-hex.png?width=150&name=roll20team-hex.png) #### The Roll20 Team In [February of this year](https://t.umblr.com/redirect?z=https%3A%2F%2Fu7086479.ct.sendgrid.net%2Fwf%2Fclick%3Fupn%3DAwrLlCB7F07TAX9qogN48W5XTUBnZ8Gsf9zzBwCK3bQjYimoOFsPvpLbgMQtSLS2ux-2BAjw7U5q-2F-2B-2F8-2BxAHjc5kKFspP7BLUlJR8xALbqyFo-3D_jqrdyix3KEBlO45VMkmke-2FNZSpvw-2Fm5b4jtI-2BXXJicwwHsUfXDEkbV9GZw4u8njnrY-2FZngfsS6HKBUTMa-2FFP-2BccQXnX8hF7ybSY1oj26CauMe3yj7CTWzPIK6iZ8z8C8WtZn9D5Npr54oqmk10LMwkYRjWCet8BcEa379YkHEs3uATnK8DSw32H8h0tr-2FmR-2BeKD-2FRjnwI0Lm-2Bfv3jevneCNPLAV0dppIfbRRWJNe4A460ITB8U7wTcbeD3ciqGkoa8F-2BizxHhCeuRiIbHACWhq48u05Fi0uSwswqopzzygtMrp1h3ZqU82-2FF6JVdmO6j&t=M2IxMDc4OTNlYzEzM2M5MzdmOWI0ZWFlY2M0YjI4MjZhOTJjNzRjOSxTZXdTSkpsNA%3D%3D&b=t%3AAWOiB2yTKRq7_ROi5nEu2g&p=https%3A%2F%2Fblog.roll20.net%2Fpost%2F186963124325%2Fconclusion-of-2018-data-breach-investigation&m=1&ts=1610475055) we became aware of information claiming to be from the [Roll20](https://t.umblr.com/redirect?z=https%3A%2F%2Fu7086479.ct.sendgrid.net%2Fwf%2Fclick%3Fupn%3DAwrLlCB7F07TAX9qogN48e4p9JeK7jodvEJlo7K8oNY-3D_jqrdyix3KEBlO45VMkmke-2FNZSpvw-2Fm5b4jtI-2BXXJicwwHsUfXDEkbV9GZw4u8njnxcK-2BkHnPDV4b1yrfViPqusHUe-2B1r5mvPLf5kgF1O-2FB-2BBrXcE1Z98vMaFVpCh-2BtEXZPtqHoPfOQYuoxb6RIjmCiaul7HO0UfOXoVo8eZWivDZOanm0xCoIZxQ2eCmmEDpjd2P-2BV1bowdfvllE0KkxrB4DqyhAv4VPs5tboKhDjdz8qLbFpnwoZUWXBGyCZRvHNKNpOGN-2BwwrmS9RAzVAQGv4ki6AiRUAqrU-2FwvnwESP7tnJWnu5fTGDecAshG4rzG&t=MTdiZmJmZDYwMTc3Y2U3YmVhYzA4MjIwOGM1MTg1NjA5MzNiOGFlZSxTZXdTSkpsNA%3D%3D&b=t%3AAWOiB2yTKRq7_ROi5nEu2g&p=https%3A%2F%2Fblog.roll20.net%2Fpost%2F186963124325%2Fconclusion-of-2018-data-breach-investigation&m=1&ts=1610475055) “accounts table” being placed for sale on a dark web marketplace for $208; an amount less than comparable data sets. We immediately announced this information to Roll20 users and the public. This data represented approximately four million users from the end of 2018, and contained the following data: - Name (both moniker and first/last as listed) - Email address - Last four digits of credit card - Most recent IP address - Salted password hashes ([bcrypt](https://t.umblr.com/redirect?z=https%3A%2F%2Fu7086479.ct.sendgrid.net%2Fwf%2Fclick%3Fupn%3DAwrLlCB7F07TAX9qogN48ROpI5EVGotg2c6KLQFaCyBx2suX60zcV5Hi-2FHF908DS_jqrdyix3KEBlO45VMkmke-2FNZSpvw-2Fm5b4jtI-2BXXJicwwHsUfXDEkbV9GZw4u8njn3JlimYgHjptYyc5ebzaJwuYqC7ZsWv02Dp-2FrNF93r6UivxJMDRSWdFnikb7GxT4N-2Fe2xa1OKf0wauBb-2F9NkrdXtbhsyj-2F-2Bj3K6BKcl-2FiCURykMjjNzWPAI1EwxbRtALm2oqxMKfG0BY9p9E1JuAKFo-2Fp29E0egVFkwWltz6Dh4yg8LEQh-2BZ3JJf55Fx9jqXDbz3-2FpaxS1NPUzbZKh2z-2BZbp-2BFgl5lXXdFEgCo17VFdcY514mY1LbSudUGD0XYWfH&t=YzcyN2RhNTQ1OTQxM2FjYzgxODg5NGY0MGUwY2FlMDYyZDNlZTE5MCxTZXdTSkpsNA%3D%3D&b=t%3AAWOiB2yTKRq7_ROi5nEu2g&p=https%3A%2F%2Fblog.roll20.net%2Fpost%2F186963124325%2Fconclusion-of-2018-data-breach-investigation&m=1&ts=1610475055)) - Roll20 Gaming data (time played) Upon becoming aware of this data sale, our legal team engaged [Kroll](https://t.umblr.com/redirect?z=https%3A%2F%2Fu7086479.ct.sendgrid.net%2Fwf%2Fclick%3Fupn%3DAwrLlCB7F07TAX9qogN48cVimGvFdiJGVEFAGHTg6rI-3D_jqrdyix3KEBlO45VMkmke-2FNZSpvw-2Fm5b4jtI-2BXXJicwwHsUfXDEkbV9GZw4u8njnzODJcIqamrcqiYVELiEjIBABbGZX-2FwHnEhG6IaKnQTGPGRuTuvVmvIh53VaXuFYL-2Fa-2Flo-2FFlUNW0PEkw-2BUqX0S3biPsdbWIYfW-2Bl28Kr0fYfDoVpEfA4YeOqiQKT1UxSAzTK3R4V9B77SEHrjItZgpp1xV-2FUyQvYl3ePkykma6dIM6GzprCQnmrMgVPT-2BOyZgi3-2B16v5WCIUXaOAePdETVydWkx3XtD9-2FZeiJ844ZKjl1DYYQuKVIY2PiPxbwMps&t=YmUyMDA2NjUzMjg3Nzg1MGE3MTlmYzYxNzQ2ZDU4ZGNkMGE0NjI2YSxTZXdTSkpsNA%3D%3D&b=t%3AAWOiB2yTKRq7_ROi5nEu2g&p=https%3A%2F%2Fblog.roll20.net%2Fpost%2F186963124325%2Fconclusion-of-2018-data-breach-investigation&m=1&ts=1610475055), who proceeded to review available logs from our cloud environments, email and other internal company communication methods, as well as actively monitoring further access to those systems. As of this time, the investigation has concluded. The investigation identified several possible vectors of attack that have since been remedied. Best practices at Roll20 for communications and credential cycling have been updated, with several code library updates completed and more in development. Additionally, all sessions were logged out of Roll20 as a precautionary measure at the time we became aware of the breach. Any user that wishes to see an example of their compromised data can contact [team@roll20.net](https://t.umblr.com/redirect?z=mailto%3Ateam%40roll20.net&t=Y2YwNzIwNTU4NjgxZTcyMGQ4NjVlZGFkNjcwZTFhYzdkNThkZTEwYSxTZXdTSkpsNA%3D%3D&b=t%3AAWOiB2yTKRq7_ROi5nEu2g&p=https%3A%2F%2Fblog.roll20.net%2Fpost%2F186963124325%2Fconclusion-of-2018-data-breach-investigation&m=1&ts=1610475055) and request that of myself (Jeffrey Lamb). Be advised that it will merely be the personalized version of the information listed above, and that we will not be providing in-depth information on attack vectors, so as to not advise malicious actors as to our defenses. Roll20 would advise users at this time that various data protection companies are making alerts, meaning it is likely that bad actors have purchased the data. We would always recommend regularly rotating passwords, as well as not sharing credentials between sites. Additional identity theft [resources are also available](https://t.umblr.com/redirect?z=https%3A%2F%2Fu7086479.ct.sendgrid.net%2Fwf%2Fclick%3Fupn%3DAwrLlCB7F07TAX9qogN48drY06RQvO-2BX53SukTzd92nt7gL4jdF-2FJmR53zOuKE36_jqrdyix3KEBlO45VMkmke-2FNZSpvw-2Fm5b4jtI-2BXXJicwwHsUfXDEkbV9GZw4u8njns9UDobQkSVEmpedQx7p7nj5uw0T9VpxjyvjWdeISurukCVKwunPzsX8ki410V9kaLNjLv9QzWMo-2BsGkBMOix8dSANFm3ql1GTfT3bqsqzMzb9wD42qy4Fsoi8tQrt80gINnXW7ZnOO59lS70itxQHhjZy2v1k5v4gSCgzN4-2F6xF-2BjtAh5knd-2BFNAwA4PAeVJ1Enl83aYaEV4BBeeFmVY3OlgTXZvWh02gH73KKY-2FphfkytTJLkHB21H3kQoWB4Mh&t=MDNhMDM3NDlkMzBmNjZhZWQwZTMxZmRkZGU2NGIyMGQ4YjAzZmY3NSxTZXdTSkpsNA%3D%3D&b=t%3AAWOiB2yTKRq7_ROi5nEu2g&p=https%3A%2F%2Fblog.roll20.net%2Fpost%2F186963124325%2Fconclusion-of-2018-data-breach-investigation&m=1&ts=1610475055) via the Federal Trade Commission. Frankly, this sucks. But from the very beginning of our platform we were aware that we are an attractive hacking target, and have sought to mitigate the amount of data we hold in order to lessen the adverse effects of potential breaches. We will continue to build upon these efforts and implement ongoing new security practices to protect your information on [Roll20](https://t.umblr.com/redirect?z=https%3A%2F%2Fu7086479.ct.sendgrid.net%2Fwf%2Fclick%3Fupn%3DAwrLlCB7F07TAX9qogN48Vzc1UH8wANCUvTuCwJ03hM-3D_jqrdyix3KEBlO45VMkmke-2FNZSpvw-2Fm5b4jtI-2BXXJicwwHsUfXDEkbV9GZw4u8njnMKrhhK9AUYvMRi5blBv7hcxcdPacxVAgWbseax-2Bqmn7s6ywSGmaLetACjI4l1zIQuxUPoE6h7hh4p21OPHIfKcUiQhPbhB0JfXv65I48h6S8nUdMtDO1sMnN2IlAP5tAjFwOFMSETEcBwaloWsMljwNaZ85cv-2FH6nWsThl22UiTBMzHYoaXGFoR2cCX43hMf4PKJddbl02XNZQc9kro6A0fJanoDGPESmxVjMdKYful6cV2HD7qN4pkR4LanFmlm&t=MDJjMzM5NGUwODE1OTBiMGYyZmJiNzRlNzQyYTc5ZjY5ZjkwMDk5ZSxTZXdTSkpsNA%3D%3D&b=t%3AAWOiB2yTKRq7_ROi5nEu2g&p=https%3A%2F%2Fblog.roll20.net%2Fpost%2F186963124325%2Fconclusion-of-2018-data-breach-investigation&m=1&ts=1610475055). Jeffrey Lamb, Data Protection Officer *Note: You may have received or will soon receive an email with the above information, so if you’re reading this twice, it’s not deja vu!* ![The Roll20 Team](https://bloghub.roll20.net/hubfs/roll20team-hex.png) The Roll20 Team ROLL20 Roll20 is the all-in-one solution for organizing and playing tabletop games online, allowing you to play your games anywhere and share them with anyone virtually. With the ability to choose from a number of popular titles built ready for your virtual tabletop, your adventures are limitless and you can get started playing with little to no prep. Dive into advanced features like Dynamic Lighting or explore macros and APIs to add some extra depth to your game. Roll20 lets you play your tabletop games, your way. [YouTube](http://www.youtube.com/roll20app) [Instagram](http://www.instagram.com/roll20app/) [Twitter](http://www.twitter.com/roll20app) ![image description](https://bloghub.roll20.net/hubfs/Roll20%20-%20Assets/Blog/img-02.png) ![image description](https://bloghub.roll20.net/hubfs/Roll20%20-%20Assets/Blog/soldiers.png) SIGN UP ### Play on Roll20 for Free Play games anywhere. Share them with anyone. With Roll20 as your virtual tabletop, your adventures are limitless. [Create Free Account](https://app.roll20.net/account/create) [![Roll20](https://bloghub.roll20.net/hubfs/logo-white.png)](https://roll20.net/) - [Blog](https://bloghub.roll20.net/roll20-blog) - [Marketplace](https://marketplace.roll20.net/) - [Community](https://app.roll20.net/forum/) Subscribe to Our Newsletter © Roll20, LLC Roll20® is a Registered Trademark of Roll20, LLC. All rights reserved. - - - - - - - [Privacy Policy](https://help.roll20.net/hc/en-us/articles/360037770793-Terms-of-Service-and-Privacy-Policy) - [Terms & Conditions](https://help.roll20.net/hc/en-us/articles/360037770793-Terms-of-Service-and-Privacy-Policy)