Divine Skins Data Breach (2026)

On March 13, 2026, the League of Legends custom skins service Divine Skins disclosed that an unauthorised third party had accessed part of its systems, deleted all skins from its database, and exposed the email addresses, usernames, and purchase histories of 106,000 users.

What's Publicly Reported from Reporting

Public reporting from Have I Been Pwned indicates the breach occurred in early 2026. Divine Skins notified users through its official Discord server, stating that the intruder gained access to a portion of its infrastructure. The compromised data set includes email addresses, usernames, and a complete history of purchases made through the service. No passwords or payment card details were listed among the exposed records. The service confirmed that all custom skins stored in its database were wiped as part of the incident.

Why This Matters for You and Your Family

If you or anyone in your household has ever bought custom skins through Divine Skins, your email address and username are now publicly available. That combination is often enough for attackers to begin linking your gaming identity to your real-world identity. Once connected, the same credentials you used for Divine Skins can be tested against your email provider, streaming accounts, or other gaming platforms your family uses. Children who play League of Legends are especially exposed because their usernames frequently match accounts on Roblox, Discord, or Steam. A single leak like this can quietly hand attackers the starting point they need to harass, impersonate, or financially target your family.

The Doxxing and Identity-Chain Risks

Username and email leaks rarely stay isolated. Attackers use them to map what security professionals call an identity chain — linking your gaming handle to your main email, social media profiles, phone number, and home address. With purchase history included, someone can see exactly which skins you bought and when, adding personal details that make social engineering attacks more convincing. The deleted skins add insult to injury: legitimate customers lost access to paid content while their personal information circulated. Available reporting describes similar gaming-related breaches where initial credential leaks cascaded into account takeovers, doxxing campaigns, and extortion attempts aimed at both adults and children.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the included cleanup of data broker records tied to those connections.
• Rotate the password you used at Divine Skins anywhere else it is reused and immediately enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak exposing you or your family is caught and acted upon within hours.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children's gaming accounts that often chain back to the same email address or home location.
• Let DoxxScan remediation specialists handle takedown requests for any newly exposed personal information while you focus on securing the accounts that matter most to your family.

The incident shows how quickly a seemingly minor gaming service breach can feed larger doxxing and account takeover campaigns. Starting with a clear picture of your current exposure and maintaining ongoing visibility is the most practical defense for ordinary families. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts.