A hacker has reportedly posted several internal documents online stolen from a Roblox employee, which the company said were stolen by cyber criminals through social engineering tactics.
The documents appear to contain personal information of multiple individuals and relate to some of the most popular games and creators on the platform, as reported by Motherboard.
The hacker behind the attack released a 4GB archive of documents and posted a selection of images in a Roblox forum post. The files include email addresses, identification documents, and spreadsheets which appear to relate to creators from Roblox.
RELATED RESOURCE
Roblox is a platform that allows users to create and design their own games or worlds and play other users’ games while deploying microtransactions to monetise them. It’s worth around $68 billion and the company has claimed in the past that half of all children in the US play it in some form.
“Roblox has been actively investigating a phishing incident, which involved a Roblox employee being targeted by cyber criminals through social engineering tactics and using highly personalised scare tactics,” a Roblox spokesperson told IT Pro. “These stolen documents were illegally obtained as part of an extortion scheme that we refused to cooperate with. We acted quickly upon learning of the incident, engaged independent experts to complement our information security team and have tuned our systems to seek to detect and prevent similar attempts.”
This isn’t the first time the gaming platform has been targeted by hackers, as in 2020 a hacker bribed a Roblox employee to gain access to its back-end customer support panel. This allowed them to look up the personal information of over 100 million users and grant virtual in-game currency. The hacker was able to see users’ email addresses and change their passwords too. They could also ban users and remove two-factor authentication from their accounts.
Meanwhile, Bandai Namco, a video gaming giant, confirmed last week it had been the victim of a cyber attack. The organisation confirmed that several of its companies in Asian regions were breached by a third party on 3 July 2022. Some reports claimed that a ransomware group, that uses the names AlphV and BlackCat, were behind a large ransomware attack on the gaming company.
-
What is polymorphic malware?Explainer Polymorphic malware constantly changes its code to avoid detection, making it a top cybersecurity threat that demands advanced, behavior-based defenses
-
Outgoing Kaseya CEO teases "this is just the beginning" for the companyOpinion We spoke to Fred Voccola who remains a key figurehead at the firm as it enters its next chapter...
-
Hackers are using Zoom’s remote control feature to infect devices with malwareNews Security experts have issued an alert over a new social engineering campaign using Zoom’s remote control features to take over victim devices.
-
State-sponsored cyber groups are flocking to the 'ClickFix' social engineering techniqueNews State-sponsored hackers from North Korea, Iran, and Russia are exploiting the ‘ClickFix’ social engineering technique for the first time – and to great success.
-
Have I Been Pwned owner Troy Hunt’s mailing list compromised in phishing attackTroy Hunt, the security blogger behind data-breach site Have I Been Pwned, has fallen victim to a phishing attack targeting his email subscriber list.
-
LinkedIn has become a prime hunting ground for cyber criminals – here’s what you need to knowNews Cyber criminals are flocking to LinkedIn to conduct social engineering campaigns, research shows.
-
Phishing campaign targets developers with fake CrowdStrike job offersNews Victims are drawn in with the promise of an interview for a junior developer role at CrowdStrike
-
Iranian hackers targeted nuclear expert, ported Windows infection chain to Mac in a weekNews Fresh research demonstrates the sophistication and capability of state-sponsored threat actors to compromise diverse targets
-
Malware being pushed to businesses by search engines remains a pervasive threatNews High-profile malvertising campaigns in recent months have surged
-
CISA: Phishing campaign targeting US federal agencies went undetected for monthsNews Threat actors used legitimate remote access software to maliciously target federal employees
