Earlier today (2/14), Roll20 was named in a report as one of several victims of an attack by cybercriminals. While we can confirm a breach did occur, we are currently focused on finding out all the facts. For now, it’s important to note the report makes clear that no financial data was included in the breach. Our security teams work tirelessly to fix potential weaknesses in our systems, and we take seriously our responsibility to safeguard our users’ personal information. Here’s how we do that: Roll20 only maintains the following personal information: users’ name, email address, hashed password, last login IP and time of login, and the last 4 credit card digits. We use Stripe and PayPal to process transactions; all billing information is handled by them and never touches our servers. We utilize bcrypt for password hashing, which means that it cannot be reverse-engineered for utilization with other sites or to access Roll20. We know it’s frustrating to not have all the facts, and we’re working to uncover the full extent of this breach. We will be continuously updating our members with information as our investigation continues. UPDATE 2/15 2:45 PM PT: Based off the account numbers from breached data, we've determined this took place on approximately December 26th.
The data size (~700MB) is consistent with being our "account object," which, as earlier stated, contains name, email address, last four of credit card, most recent IP address, and hashed & salted password. While the hash & salt should keep passwords safe, it never hurts to reset.
We are continuing to work internally and with outside investigators to determine the methodology of breach, while also fulfilling GDPR requirements and notifying appropriate law enforcement.
Expect more details early next week. UPDATE 2/22 1:00 PM PT : We wanted to give an update, even though there is a limited amount that can be offered at this time. We’re working with legal and an outside security firm to confirm elements of the breach and attempt to determine its vector. We’re working to advance these steps as quickly as possible, but know this will be an ongoing process. In terms of immediate aftermath, we feel fortunate that the scope appears limited. We know, given our market, that your data is an attractive target-- which is why we’ve intentionally stored and processed minimal information, and been diligent in protecting what is necessary for us to have. We appreciate how understanding the community has been in the process, and will continue to give updates as we’re able. Update 8/12 1:00 PM PT: The complete investigation has been officially concluded, with details given in the blog post here: <a href="https://blog.roll20.net/post/186963124325/conclusion-of-2018-data-breach-investigation" rel="nofollow">https://blog.roll20.net/post/186963124325/conclusion-of-2018-data-breach-investigation</a>