Ukrainian Trio Faces Trial for Mass Roblox Account Theft Scheme
Three Ukrainian nationals are set to stand trial for allegedly stealing and selling over 610,000 Roblox accounts to buyers in Russia between May 2025 and April 2026. According to prosecutors in Ukraine’s Lviv region, the group exploited stolen session tokens known as cookies to hijack accounts without needing passwords, then assessed their value based on virtual currency, rare items, or other digital assets.
The operation was led by a 19-year-old from Drohobych, who recruited two 22-year-old associates. The group used malware disguised as gaming cheats or free in-game bonuses to harvest credentials, later filtering accounts through specialized software to identify high-value targets. Premium accounts were sold individually, while lower-value ones were bundled and offered at a discount.
Advertised on Russian platforms and paid for via cryptocurrency, the stolen accounts fetched as little as 70 Russian rubles ($0.80) each. Prosecutors estimate the scheme could have generated up to $480,000, with investigators tracing nearly $54,000 in cryptocurrency proceeds converted into Ukrainian currency.
All three suspects remain in custody, facing charges including theft, money laundering, unauthorized computer interference, and illegal sale of restricted information, with potential sentences of up to 12 years in prison. The case was first announced in April after authorities identified the alleged organizer and uncovered the full scope of the operation.
Source: https://therecord.media/ukraine-roblox-hacker-arrested
Roblox cybersecurity rating report: https://www.rankiteo.com/company/roblox
"id": "ROB1789576387",
"linkid": "roblox",
"type": "Breach",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '610,000 accounts',
'industry': 'Gaming/Technology',
'location': 'Global (primarily affected users in '
'Russia)',
'name': 'Roblox',
'type': 'Company'}],
'attack_vector': 'Malware (disguised as gaming cheats or free in-game '
'bonuses)',
'data_breach': {'data_exfiltration': 'Accounts sold on Russian platforms',
'number_of_records_exposed': '610,000',
'personally_identifiable_information': 'Potential (account '
'details, virtual '
'assets)',
'sensitivity_of_data': 'High (account access, virtual assets, '
'PII)',
'type_of_data_compromised': 'Roblox account credentials '
'(session tokens)'},
'date_publicly_disclosed': '2026-04',
'description': 'Three Ukrainian nationals are set to stand trial for '
'allegedly stealing and selling over 610,000 Roblox accounts '
'to buyers in Russia between May 2025 and April 2026. The '
'group exploited stolen session tokens known as cookies to '
'hijack accounts without needing passwords, then assessed '
'their value based on virtual currency, rare items, or other '
'digital assets. The operation was led by a 19-year-old from '
'Drohobych, who recruited two 22-year-old associates. The '
'group used malware disguised as gaming cheats or free in-game '
'bonuses to harvest credentials, later filtering accounts '
'through specialized software to identify high-value targets. '
'Premium accounts were sold individually, while lower-value '
'ones were bundled and offered at a discount. Advertised on '
'Russian platforms and paid for via cryptocurrency, the stolen '
'accounts fetched as little as 70 Russian rubles ($0.80) each.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'Roblox',
'data_compromised': '610,000 Roblox accounts',
'financial_loss': '$480,000 (estimated potential revenue), $54,000 '
'(traced proceeds)',
'identity_theft_risk': 'Risk of account takeover and associated '
'identity theft',
'systems_affected': 'Roblox user accounts'},
'initial_access_broker': {'data_sold_on_dark_web': 'No (sold on Russian '
'platforms)',
'entry_point': 'Malware disguised as gaming cheats '
'or free in-game bonuses',
'high_value_targets': 'Accounts with virtual '
'currency, rare items, or '
'other digital assets'},
'investigation_status': 'Ongoing (trial pending)',
'motivation': 'Financial gain',
'post_incident_analysis': {'root_causes': 'Exploitation of stolen session '
'tokens (cookies), lack of '
'multi-factor authentication for '
'account access'},
'references': [{'source': 'Ukrainian prosecutors (Lviv region)'}],
'regulatory_compliance': {'legal_actions': 'Charges include theft, money '
'laundering, unauthorized computer '
'interference, and illegal sale of '
'restricted information'},
'response': {'law_enforcement_notified': 'Yes (Ukrainian authorities)'},
'threat_actor': 'Three Ukrainian nationals (ages 19 and 22)',
'title': 'Ukrainian Trio Faces Trial for Mass Roblox Account Theft Scheme',
'type': 'Account Hijacking',
'vulnerability_exploited': 'Stolen session tokens (cookies)'}