Summary
VRChat has disclosed a data breach affecting approximately 2.4 million user accounts in the United States. The company discovered unauthorized access to data stored in its cloud environment in May 2026 and has now confirmed the scope of the compromise.
Exposed information includes VRChat usernames, email addresses, VRChat+ subscription status, login history, and linked Steam or Meta user IDs. VRChat stated that passwords, credit card numbers, and payment information were not accessed in the incident.
The breach is particularly sensitive given VRChat’s position as a social VR platform where users maintain persistent virtual identities. The exposed data could enable targeted phishing, social engineering, or doxxing of users whose real identities may not have been previously linked to their VR personas.
Source
Claim Depot — VRChat Breach Report
Commentary
While VRChat assures users that passwords and payment data weren’t touched, the exposed data is more valuable than it appears on the surface. Linking email addresses to VRChat usernames — and by extension to Steam and Meta accounts — gives attackers a rich identity graph. For many users, their VR identity is deliberately separate from their real-world identity, and this breach collapses that boundary.
The 2.4 million affected users represent a significant portion of VRChat’s active user base. Cloud environment breaches continue to be a recurring theme in 2026, and this incident reinforces that even platforms not handling financial data still carry significant privacy risk when social identity data is exposed.