Three Ukrainians Charged Over Massive Roblox Account Hack Linked to Russian Buyers

Ukrainian prosecutors announced that three individuals will face criminal charges for allegedly infiltrating more than 610,000 Roblox user accounts and funneling the compromised credentials to buyers in Russia.

According to the indictment, the suspects gained unauthorized access to the gaming platform’s accounts through a combination of phishing tactics and credential‑stuffing attacks. Once inside, they harvested login details and packaged the information for resale on underground forums that cater to cyber‑criminals seeking to monetize online gaming identities.

The case is being pursued by Ukraine’s specialized cybercrime unit, which says the operation violated multiple provisions of the nation’s criminal code, including illegal access to computer systems and illegal trafficking of personal data. The three defendants are expected to appear before a Kyiv court later this month, where they will be formally arraigned and held pending trial.

Authorities highlighted the broader context of heightened cyber activity amid the ongoing conflict between Russia and Ukraine. While the war has spurred a surge in state‑linked and independent hacking campaigns, the alleged scheme appears to be financially motivated rather than directly tied to espionage, according to officials familiar with the investigation.

Roblox, a platform that hosts user‑generated games and social experiences for millions of primarily younger players, has warned its community about the risks of credential reuse and phishing scams. The company’s security team has since mandated password resets for affected accounts and urged users to enable two‑factor authentication to mitigate future breaches.

Legal experts note that the outcome of the trial could set a precedent for how Ukrainian courts handle transnational cyber‑theft cases, especially those involving victims and buyers across borders. Prosecutors have indicated that sentencing, if convictions are secured, could include substantial prison terms and fines, reflecting the scale of the theft and its impact on a global user base.