VICE's Joseph Cox reports an alleged bribery-for-access attack inside Roblox: one employee was paid to look up high-profile users and reset their passwords, making the insider — not a code exploit — the attack surface. The report lands in a stretch where Roblox's security posture keeps surfacing in leaks, from internal docs detailing its China expansion plans to moderation practices.
The pattern extends beyond Roblox: weeks after this story, hackers breached EA using cookies bought online for $10 and social-engineered IT support, showing game-industry attackers increasingly buy access rather than break it. Roblox's later disclosure that attendee data from years of its Developer Conference had leaked underscores how long tail risks linger at the platform.
First-order effects
High-profile Roblox users face immediate account-takeover risk: the bribed employee could pull their personal information and reset passwords, so those accounts need forced credential changes and heightened monitoring right now.
Roblox must treat this as an insider-threat incident — auditing which employees hold lookup and password-reset powers over user accounts, not just patching external vulnerabilities.
Second-order effects
Other game platforms with large minor audiences and valuable accounts now have to assume staff can be bought, pushing employee access controls and privileged-action logging up the security budget ahead of perimeter defenses.
The cheap-access playbook visible in the EA cookie-and-social-engineering breach suggests attackers will keep targeting people and credentials across gaming companies, raising the cost of trust-based support workflows industry-wide.
Third-order effects
If bribery-for-access proves repeatable, game platforms drift toward least-privilege architectures where no single employee can view or reset a user's account alone — a structural change to how customer support operates at scale.
Repeated disclosures like the delayed Developer Conference attendee leak point toward tighter breach-notification expectations for platforms whose user bases include children, where regulators are likeliest to step in.
The trend: Game-platform breaches are shifting from technical exploits toward purchased human access — bribed insiders and cheap stolen credentials — forcing the industry to harden its people as much as its code.
Criminal bribed Roblox employee, gaining access to back end customer support panel of the online video game, giving them the ability to lookup personal information on over 100 million active monthly users and grant virtual in-game currency. https://www.vice.com/...
This reminds me of the April 1st, 2012 hackings. I've always thought the moderation team on @Roblox was never professional nor held accountable for harrasing users and or banning users for petty things. I truly hope this is a wake up call for @DavidBaszucki https://twitter.com/..…
This is some of the stuff the Roblox hacker could have done, and did some of to at least a few accounts. If you can't hack a site/service/application, the customer support reps may help you out for a little bit of cash https://www.vice.com/... https://twitter.com/...
Not only does this show how much of a threat insiders at companies can be, but also how accessing data of children can be pretty straight forward. Roblox has a huge community of children using it; also used for kids parties during COVID-19 https://www.vice.com/... https://twitter…
A hacker gained access to the massively popular online video game's backend, giving them access to the personal information of over 100 million actively monthly users. https://www.vice.com/...
Here's a screenshot the hacker shared showing Roblox's back end customer support portal. Look up private email addresses, grant players in-game currency. Hacker says they reset passwords and stole items to sell https://www.vice.com/... https://twitter.com/...
New: a hacker bribed an insider at massively popular online video game Roblox to access private user data, reset passwords, disable 2FA, more. Could perform all sorts of actions; Roblox says it has 100 million users https://www.vice.com/...
One of the most high profile users in Roblox confirmed their account information was exposed. I showed them an email address the hacker found; they said this was their private, dedicated email address only for using this game https://www.vice.com/... https://twitter.com/...
The hacker sent messages between them and the insider. According to LinkedIn, this person worked for a contractor that works for Roblox. Targeting customer support reps is fruitful for hackers; lots of data access, potentially fewer controls in place https://www.vice.com/... http…