Recommended Free Tools
Roll20 disclosed a data-security incident on July 3, 2024, after an unauthorized actor accessed an account on the platform’s administrative website on June 29. Roll20 said the intruder could view and modify user accounts for about an hour. Names, email addresses, last-known IP addresses and, where stored, the last four digits of payment cards may have been viewable.
Roll20 said passwords were not exposed and that it did not store full payment-card numbers on its own servers. However, the company did not disclose a confirmed number of affected users or establish whether information was downloaded or misused.
As an Amazon Associate I earn from qualifying purchases.
What happened to Roll20?
According to Roll20’s incident FAQ, the company learned at approximately 6:30 p.m. Pacific time on June 29, 2024, that a bad actor had gained access to an account on its administrative website.
The unauthorized access lasted about one hour. Roll20 said it blocked access by approximately 7:30 p.m. Pacific time, reversed changes made to one user account and notified users in writing. The compromised administrative account had the ability to access and view all user accounts during the incident window.
#1 Best Overall
This was an administrative-account compromise—not a confirmed theft of Roll20’s entire database. The fact that information could be accessed or viewed does not establish that it was downloaded, published, sold or misused.
What information may have been exposed?
| Potentially viewable | Roll20 said was not exposed |
|---|---|
| First and last names | User passwords |
| Email addresses | Full payment-card numbers |
| Last-known IP addresses | |
| Last four digits of a stored payment card |
Roll20 said passwords were stored as salted bcrypt hashes. In practical terms, bcrypt stores a deliberately difficult-to-reverse representation of a password rather than the password itself. That reduces the risk of large-scale password recovery, but it is not a reason to reuse passwords or ignore suspicious activity.
Roll20 also said full card numbers were not stored on its servers. Its privacy policy and terms identify Stripe as its payment service and state that Roll20 does not have access to users’ full card numbers.
What remains unknown?
The available public notices do not provide a confirmed affected-user count, the number of records viewed, the amount of data downloaded, the method used to compromise the administrative account or the identity of the attacker.
TechCrunch reported that Roll20 had not answered questions about those details, including how many users had stored payment methods. Roll20 said it had no evidence that the information had been misused, but potential exposure could not be ruled out.
Were game campaigns or private game content exposed?
Roll20’s public notice focused on account information available through the administrative system. It did not establish that campaign maps, character sheets, private messages, game assets or other gameplay content were downloaded.
The safest conclusion is that the notice does not confirm exfiltration of campaign or gameplay content. It also should not be expanded into a claim that all game content was definitely unaffected.
What should Roll20 users do?
- Change reused passwords. Roll20 said passwords were not exposed, so its notice does not by itself imply that every user needs an emergency password reset. But any password used on Roll20 and another service should be changed on every affected service immediately.
- Use a unique password for Roll20. A password manager such as 1Password, Bitwarden or Proton Pass can generate and store unique credentials. A manager cannot remove exposure of an email address or IP address, but it helps prevent password-reuse attacks.
- Be alert for phishing. An email containing your name or references to Roll20 may appear credible. Do not use unsolicited password-reset or payment links. Open Roll20 by navigating directly to its official website or help center instead.
- Review payment activity. The last four digits of a card are not sufficient to charge it, and Roll20 said full card numbers were not stored on its servers. Still, review statements and payment notifications and contact your card issuer if you see an unfamiliar transaction.
- Request incident-related account data. Roll20 said users could contact its help center with the subject line “Incident Data Request” to ask for a copy of account data the actor may have been able to access. The relevant FAQ contains the request instructions.
- Report suspicious account changes. An unfamiliar email change, campaign change, purchase, message or login should be treated as a separate account-security incident. Preserve relevant emails and screenshots, then contact Roll20 support.
You can also check whether your email address appears in known breach datasets through Have I Been Pwned. A result does not prove involvement in this particular Roll20 incident, and no result does not prove that an account is safe.
Does this relate to Roll20’s older breach?
No connection has been established between the June 2024 administrative-account compromise and the older incident associated with data said to date from 2018.
TechCrunch separately reported historical claims involving Roll20 records that were disclosed in 2019. Those claims should be treated as separate background, with their scope and authenticity attributed carefully. They are not evidence that the 2024 event was the same breach or part of one continuous attack.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How serious was the incident?
The incident appears less severe than a breach involving plaintext passwords or full payment-card data, but it was not risk-free. Names, email addresses, IP addresses and partial card details can support targeted phishing, account enumeration, social engineering and identity profiling.
The practical risk is higher for anyone who reused a password, responds to unsolicited account-recovery messages or notices suspicious activity. For users with a unique password and no unusual account or payment activity, the sensible response is vigilance rather than assuming that a card replacement or paid identity-monitoring subscription is automatically necessary.
Roll20 said it planned to restrict administrative-account access, limit the data available to administrative users and add enhanced security measures. Those are company-reported response steps, not an independent finding about the effectiveness of the changes.
As of August 18, 2026, the cited sources document the July 2024 disclosure; they do not establish a new 2026 Roll20 breach.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
