{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2020-hacker-bribed-a-roblox-support-contractor-to-access-user-data-and-reset"},"incident":{"title":"Hacker bribed a Roblox support contractor to access user data and reset accounts","date":"2020-05","date_precision":"month","victim_org":"Roblox Corporation","sector":"Gaming & Casino","country":"United States","primary_vector":"Insider Recruitment","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"No AI involvement was reported.","outcomes":["Insider Access","Data Breach","Credential Theft"],"loss_usd":null,"loss_note":"No dollar loss was published. The hacker changed passwords on two accounts and took in-game items from those users.","records_affected":null,"threat_actor":"Unnamed individual who had previously sought a Roblox bug bounty","summary":"A hacker bribed a Roblox customer support representative, listed publicly as an in-game support contractor, to obtain access to the company's customer support panel. The panel exposed personal data on Roblox's user base and allowed password resets, removal of two-factor authentication, account bans and data changes. Roblox said it acted immediately, notified the small number of affected customers, and reported the hacker to HackerOne.","how_it_worked":"The attacker skipped Roblox's perimeter entirely and bought a person instead. He identified a support contractor via LinkedIn and paid them for access to the internal customer support console, which was designed to let agents administer any account. With that console the attacker could read email addresses, force password resets, strip 2FA from targeted accounts, ban users and alter records, including for high-profile creators. He used it to change passwords on two accounts and take their in-game items. Roblox had earlier denied him a bug bounty payout over suspected malicious activity, which appears to have preceded the insider approach.","lessons":"Support consoles that can reset any account need per-record justification, least-privilege scoping and anomaly alerting on bulk or high-profile lookups, so a single bribed agent cannot become a master key.","confidence":"Reported","sources":[{"title":"Hacker Bribed 'Roblox' Insider to Access User Data","url":"https://www.vice.com/en/article/hacker-bribed-roblox-insider-accessed-user-data-reset-passwords/","publisher":"Vice / Motherboard"},{"title":"Hacker Bribed Roblox Worker For Access To Users' Personal Data","url":"https://www.gamespot.com/articles/hacker-bribed-roblox-worker-for-access-to-users-pe/1100-6477149/","publisher":"GameSpot"}],"entry_type":"incident","slug":"2020-hacker-bribed-a-roblox-support-contractor-to-access-user-data-and-reset","year":2020,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2020-hacker-bribed-a-roblox-support-contractor-to-access-user-data-and-reset"}}