Aternos aternos.org Aternos data breach: what happened and what to do
In December 2015, the free Minecraft server host Aternos was breached, affecting about 1.4 million subscribers. Usernames, email addresses, IP addresses and hashed passwords were exposed.
View all 13,115 breaches- Breach date
- 6 Dec 2015
- Affected
- 1,436,486
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames, Website activity
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Aternos is a service for creating and running free Minecraft servers. In December 2015 it suffered a data breach that affected about 1.4 million subscribers. Have I Been Pwned (HIBP), the breach notification service run by Troy Hunt, added the data to its collection in October 2016.
What was exposed
HIBP lists five types of data: email addresses, IP addresses, passwords, usernames and website activity. The passwords were hashed, which means they were scrambled rather than stored as plain text. Hashing slows attackers down, but weak or common passwords can still be guessed from a hash.
What it lets criminals do
An email address plus a username is enough to send a convincing phishing message to someone who played on Aternos. IP addresses give a rough location. The bigger risk is password reuse: if you used your Aternos password on another account, someone holding the hash may try to crack it and test the result elsewhere.
The company's response
HIBP's entry links to a post from the official Aternos status account about the incident. We don't have more detail on the company's response than that.
The breach is nearly a decade old, so the practical question is whether the password you used then is still in use anywhere. If it is, change it today.
What to do if you were in it
- 1
Change any password you shared with Aternos
If you reused your Aternos password anywhere else, change it on every one of those accounts. Use a different, long password for each.
- 2
Turn on two-factor authentication
Turn on 2FA for your email and any account that matters, so a guessed password alone isn't enough to get in.
- 3
Expect phishing that mentions Minecraft
Treat messages about your server, account or game with suspicion, and go to the site directly instead of clicking links in an email.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the steps here are what protect you.
Frequently asked
Was I affected by the Aternos data breach?
If you had an Aternos account in December 2015, possibly. You can search your email address on Have I Been Pwned, or run a free Serus scan.
What was exposed in the Aternos breach?
Email addresses, IP addresses, passwords, usernames and website activity. HIBP says the passwords were hashed.
Should I change my password?
Yes, if you still use that Aternos password anywhere. Pick a new unique one for each site.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
