Loading story…
VRChat disclosed that unauthorized access to its cloud environment exposed data belonging to 2,436,782 users after an intrusion between May 10 and May 12. According to the company’s filing, the compromised information included VRChat usernames, associated email addresses, VRChat+ subscription status, login history, device and hardware identifiers, IP addresses, and linked Steam or Meta user IDs. VRChat said passwords, payment card data, and government ID documents used for age verification were not believed to be affected.
The company said it contained the incident, added security controls, and brought in external security experts to monitor for further threats. The breach raises immediate risks of phishing, account targeting, and credential-stuffing attempts against users who may have reused passwords on other services, while linked platform identifiers could enable broader identity correlation. Reporting also noted that VRChat disclosed the incident through a filing with Maine’s attorney general rather than a broad public announcement, and it did not offer identity theft or credit monitoring services.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Maine officials said their public breach notification portal was abused to publish a fabricated VRChat breach notice and removed the false entry while temporarily restricting public access and reviewing publication procedures. VRChat publicly denied any compromise, saying the notice was fake and that the named employee did not exist.
VRChat disclosed the incident in a filing with the Maine attorney general, stating that passwords, payment card data, and government ID documents used for age verification were not believed to be affected. The filing also said the company had contained the intrusion, added security controls, and engaged external security experts.
VRChat said unauthorized access to its cloud environment occurred between May 10 and May 12, 2026, exposing data tied to 2,436,782 users. The accessed information included usernames, email addresses, VRChat+ subscription status, login history, device and hardware identifiers, IP addresses, and linked Steam or Meta user IDs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcehello.vrchat.com
Open sourcemalware.news
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026
**Cloud Imperium Games (CIG)** disclosed that it suffered an IT incident on **January 21** described as a “systematic and sophisticated attack,” resulting in **unauthorized access to some backup systems** and **limited access to users’ personal data**. CIG stated the exposed information was limited to basic account details such as **names, usernames, contact information, and dates of birth**, and asserted that **no passwords** were impacted, **no financial/payment data** was accessible, access was **read-only**, and there was **no data modification**. The disclosure triggered backlash from users over **how and when** the company communicated the breach, with reporting highlighting that CIG initially surfaced the incident via a low-visibility website “service alert” popup rather than prominent notices or direct outreach. Coverage also emphasized that even “basic” identity and contact data can materially increase **phishing and social-engineering risk**, especially when combined with other breached datasets to build richer victim profiles.
Jun 29, 2026
Flash Flash Revolution, a music-based rhythm game, suffered two major account compromises that together exposed data from roughly **3.7 million** records. In the February 2016 incident, attackers breached the site's **vBulletin forum** and exposed about **1.8 million accounts**, including email addresses, IP addresses, and **salted MD5 password hashes**. A separate breach in July 2019 affected nearly **1.9 million members** and was disclosed as distinct from the earlier compromise. The later incident exposed email addresses, IP addresses, usernames, dates of birth, and **salted MD5 password hashes**, extending the scope of personal data tied to the platform and creating renewed credential and privacy risks for affected users.
Jun 29, 2026