Hacker releases 4GB archive of internal Roblox employee data online

A threat actor breached an employee account of Roblox Corporation and posted what seems to be a cache of internal documents online.

The stolen documents were obtained in an extortion scheme, with the data currently including identification documents, spreadsheets related to Roblox creators, and email addresses. No exact details on the identification documents have been revealed yet.

“These stolen documents were illegally obtained as part of an extortion scheme that we refused to cooperate with. We acted quickly upon learning of the incident, engaged independent experts to complement our information security team and have tuned our systems to seek to detect and prevent similar attempts,” Roblox told Motherboard in a statement.

The hacker has already released a 4GB archive of internal documents to the forum post for public viewing.

In the past, Roblox has fallen victim to hackers, although this affected gamers more often than the company itself. As such, earlier this year, Avanan uncovered a Trojan file hidden within a legitimate scripting engine, Synapse X, used for cheat code in Roblox, which could be used to break applications, corrupt or remove data, and send information to the hacker.

In April 2021, the Cybernews team investigation found that the Roblox app on Android appears to have numerous potential security issues under the hood that could put the platform and its players at risk.