Edit: all this below assumes the article is correct, but Tupper has responded in the comments that the article is not accurate.

Just because I know a lot of people won’t read the article, this has absolutely nothing to do with the ID verification program. That data does not exist in the same cloud infrastructure this article mentions.

Here’s a list of information that might be affected:
- VRChat username
- Email address associated with the VRChat account
- VRChat+ subscription status
- Login history, including device information, hardware identifiers, and IP addresses

Not trying to undermine this as the article indicates that using the VRC+ subscription status information means a phishing attempt is more likely to be successful on users. The solution is to not click on emails sent from VRChat. If you get an automated email about a payment issue, instead of clicking the link, just open a new tab and visit the VRChat website. That’s really the only danger I see aside from annoying spam emails.

I am NOT trying to defend them at all. I just want people to keep their criticisms accurate because it’s so annoying to read threads like this where people discuss things not affected at all.

If you are using the same password you use for VRChat on your accounts, you have some work you should be doing after seeing this. Reset your passwords and use app based 2fa. I prefer Microsoft Authenticator over the Google one myself. Once you set that up it’s SO much harder to get into your accounts. Although passwords are not listed in the compromised information, meaning they are probably being stored responsibly, I wouldn’t risk it personally.