VRChat, Inc. data breach

Clerk's notes

VRChat, Inc., operator of a well-known social virtual reality platform, formally reported a data security incident to the Maine Attorney General on June 10, 2026. This filing indicates that personal information belonging to users of its immersive 3D environments may have been compromised. The specific technical details of the breach remain under investigation.

The reported exposure includes sensitive user data categories. Affected information may consist of Full Name, Email Address, Password or Credential Hash, Mailing Address, Billing Details, Payment Card Information, Device and IP Connection Logs, and User Profile and Account Metadata. Such incidents frequently stem from unauthorized access to backend databases or third-party systems.

For individuals who received a notification, the exposure of these data types poses substantial risks. Compromised login credentials can lead to account takeovers across multiple platforms. Billing and payment card details increase the threat of financial fraud, while email and mailing addresses may be used for targeted phishing scams or identity theft. Device and IP logs can also be leveraged for further malicious activity.

As a technology company handling consumer data, VRChat, Inc. is subject to various legal standards, including obligations under Section 5 of the Federal Trade Commission Act. These regulations require robust security measures to protect user information. A data breach suggests that these mandatory safeguards may have been insufficient, creating potential legal accountability for the company.

Receiving a formal data breach notification letter confirms that your personal information was part of this incident. Individuals impacted by such events may have legal standing to participate in litigation seeking accountability and restitution. There is no requirement to demonstrate direct financial loss to qualify, as the mere exposure and heightened risk are often sufficient. We evaluate these cases on a contingency basis, meaning no out-of-pocket cost unless compensation is recovered.

If a notification letter about this breach reached you, see every Maine data breach on file or browse all cases.