RockYou

Disclosed Dec 14, 200932,000,000 affectedSettled

SQL injection exposes 32 million plaintext passwords at RockYou

A hacker used a SQL injection flaw to access RockYou's database of more than 32 million accounts, which stored passwords in plain text; the password list became a standard cracking wordlist.

What is known

People affected	32,000,000 (as reported by the organization)
Disclosed	Dec 14, 2009
Attack	Hacking
Data exposed	EmailsPasswordsCredentials and tokens
Sector	Tech · US
Status	Settled
Lawsuit or fine	FTC settlement including $250,000 COPPA civil penalty (2012) (about $250K)

Sources

Newstechcrunch.com

RockYou Hack: From Bad To Worse

Regulatorftc.gov

FTC: RockYou, Inc. (FTC Charges That Security Flaws in RockYou Game Site Exposed 32 Million Email Addresses and Passwords)

Notices filed

TotalDec 14, 2009

Research32,000,000 people

History of this record

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about RockYou