Cyber Threat Actor: RBX.Place Hacker

RBX.Place Hacker is an alias used by a threat actor known to operate from the United States of America. The actor gained public attention following a compromise of a grey marketplace for Roblox in‑game items, where user data such as email addresses, transaction records, hashed passwords with salts, IP addresses, and seller applications containing Discord and Skype usernames were exfiltrated. The breach was confirmed by victims who verified the accuracy of their own information, indicating a successful data theft operation.

The actor’s targeting appears focused on the gaming and virtual goods sector, specifically platforms facilitating unofficial Roblox item trades. Geographically, the actor’s known location is the United States, suggesting a primary operational base within that region. The strategic objective demonstrated in the reported incident is financial gain, as the stolen data was linked to unauthorized real‑money transactions that violate Roblox’s terms of service. No evidence points to espionage or disruptive aims in the publicly available sources.

Regarding tactics, the actor employed insider‑based methods, having previously bribed a Roblox insider to obtain user data and later acquiring the compromised database from another individual who had infiltrated the platform. This approach highlights reliance on social manipulation and third‑party data acquisition rather than malware deployment or exploit‑based initial access. Public attribution does not associate the actor with any state sponsor or criminal consortium, and no specific malware families, toolkits, or exploit chains have been referenced in the disclosed reports. The 2020‑06‑18 breach of the RBX.Place marketplace stands as the representative operation that illustrates the actor’s methodology and impact.