Roll20 Security Breach

[AnotherDev]

I didn’t know this happened. I received an e-mail this morning.

To all of those that use Roll20 or have in the past, Roll20 recommends changing your password immediately and checking the identity theft documents of the FTC.

https://identitytheft.gov/

The e-mail I received is below:

Conclusion of 2018 Data Breach Investigation

In February of this year we became aware of information claiming to be from the Roll20 “accounts table” being placed for sale on a dark web marketplace for $208; an amount less than comparable data sets. We immediately announced this information to Roll20 users and the public. This data represented approximately four million users from the end of 2018, and contained the following data:

• Name (both moniker and first/last as listed)
• Email address
• Last four digits of credit card
• Most recent IP address
• Salted password hashes (bcrypt)
• Roll20 Gaming data (time played)

Upon becoming aware of this data sale, our legal team engaged Kroll, who proceeded to review available logs from our cloud environments, email and other internal company communication methods, as well as actively monitoring further access to those systems. As of this time, the investigation has concluded.

The investigation identified several possible vectors of attack that have since been remedied. Best practices at Roll20 for communications and credential cycling have been updated, with several code library updates completed and more in development. Additionally, all sessions were logged out of Roll20 as a precautionary measure at the time we became aware of the breach.

Any user that wishes to see an example of their compromised data can contact [email protected] and request that of myself (Jeffrey Lamb). Be advised that it will merely be the personalized version of the information listed above, and that we will not be providing in-depth information on attack vectors, so as to not advise malicious actors as to our defenses.

Roll20 would advise users at this time that various data protection companies are making alerts, meaning it is likely that bad actors have purchased the data. We would always recommend regularly rotating passwords, as well as not sharing credentials between sites. Additional identity theft resources are also available via the Federal Trade Commission.

Frankly, this sucks.

But from the very beginning of our platform we were aware that we are an attractive hacking target, and have sought to mitigate the amount of data we hold in order to lessen the adverse effects of potential breaches. We will continue to build upon these efforts and implement ongoing new security practices to protect your information on Roll20.

- Jeffrey Lamb, Data Protection Officer

[mutation666]

weird i didnt get an email

[Novastark]

Seems like a reasonable response. I’ll have to check my email to see if I got it too. I setup an account but I never used it.

Yup, got it too.

[mutation666]

Does it show up on have I been pwned?

[Novastark]

Me? I didn’t bother checking it’s a throwaway email address anyways. I hadn’t checked it since 2016

[Klingon00]

I didn’t even remember I had created an account or for what reason. I was previously notified by check with haveibeenpwned service and then got the e-mail today. Not really sure I had any important info in there.

[AnotherDev]

Not really sure I had any important info in there.

Same lol. I think that may be the case for a lot of people. Joined once to play a campaign or two and never went back.

[SesameStreetThug]

Got the same email. Never bought anything there so they wouldn’t have the last 4 of my credit card. Really only my password hash got taken and I diversify my passwords well enough that I’m not worried.

Still sucks pretty bad.

Bonus points for them actually sending a fucking notice though.

[mutation666]

Got my email late last night so seems like its taking awhile

[Novastark]

Well, I guess it’s because there were 665 mutations before you…

cough

Anyways, yeah I didn’t have a credit card on file or anything. Speaking of that… I really hate sites that force you to keep one on file for one reason or another. No thanks! I don’t trust you to keep it safe. I’m fine having to enter every time. But maybe that’s just me.

(Well obviously it’s a must if it’s a service that’s billed monthly. I just meant general shops and such. )

[mutation666]

I did but fuck that was probably 2 credit cards ago at this point and eh last 4 w/e. Only thing that would matter is salted passwords and I dont use the same password for things that actually matter.

[Novastark]

That reminds me. I’ve never cared enough to actually look into it but you know how some sites get caught having stored the CVV number on the back that every credit card company/processor forbids in their terms? (PCI) I wonder just how badly those companies get bent over with additional processing rates or just straight up denial of service due to being too much of a risk?

Or do they simply get slapped on the wrist while the banks and in turn the consumer fits the bill for their idiocy?

[mutation666]

I mean I only give sites credit cards so I can always dispute any charges. People who use debit cards for anything but pulling out cash confuse me.

[Novastark]

lol fair point. Sorry just had banks on my mind because I was remembering doing credit card processing through one of those terminals at one of my jobs in the past because there’s always (business) customers that you don’t want to accept checks from. Though a larger number of companies probably pay electronically these days. A written check with float for a few days before it hits the account

Banks aside, I have to wonder if the site gets hit in the pocket for it. I have to assume there is something as I know they’ll drop you if you have too many fraud/disputed charges.