Data of 2.4 million VRChat users stolen

VRChat disclosed an unauthorized access incident (May 10–12, 2026) affecting over 2.4 million users in its cloud environment; exposed fields varied by account but may include usernames, associated email addresses, VRChat+ subscription status, and login history (device information, hardware identifiers, IP addresses). VRChat states that passwords, payment card data, and age-verification government IDs were not accessed. The report warns of phishing, credential-stuffing, and identity-correlation risks and advises affected users to be cautious, enable 2FA, and change reused passwords.