Minehut minehut.com Minehut data breach: what happened and what to do
In May 2019, the Minecraft server site Minehut lost a database backup. About 397,000 email addresses were exposed, and a later data set also included bcrypt password hashes. Have I Been Pwned added it in September 2019.
View all 13,115 breaches- Breach date
- 17 May 2019
- Affected
- 396,533
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In May 2019, Minehut, a website that hosts Minecraft servers, suffered a data breach. The company said a database backup had been obtained, and it told the affected users afterwards.
About 397,000 email addresses from the incident were provided to Have I Been Pwned (HIBP), the free breach-tracking service. A second data set, which paired email addresses with bcrypt password hashes, was handed to HIBP later. Bcrypt is a slow hashing method built to make stolen passwords hard to crack, but short or common passwords can still be guessed.
What was exposed
Email addresses and passwords (as hashes). No other data types are listed in the HIBP entry.
An email address tied to a gaming account is enough for phishing that mentions Minecraft or server hosting. If you used the same password on other sites, a cracked hash can open those accounts too, which is how most of the real damage from a breach like this happens.
What Minehut did
Minehut told the users it identified as affected. The sources linked below don't describe further steps, so check your inbox (and spam folder) for any notice from the company.
If you had a Minehut account in 2019, treat the password as known and change it wherever you still use it.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on Minehut. If you used the same password anywhere else, change it there too, ideally with a password manager that generates a different one for each site.
- 2
Turn on two-factor login
Add an authenticator app or security key to your email, banking and shopping accounts first. A stolen password alone then won't get anyone in.
- 3
Expect phishing that mentions the breach
Emails and texts that quote your Minehut account, or claim to be from the company, are a common follow-up. Don't click links in them: go to the site directly instead.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number, and get an alert if a new one turns up.
Frequently asked
Was I affected by the Minehut data breach?
If you had a Minehut account in May 2019, possibly. HIBP lists about 397,000 email addresses from this breach. Searching your email on Have I Been Pwned or running a free Serus scan shows whether yours is among them.
What was exposed in the Minehut breach?
Email addresses and passwords. A later data set held email addresses with bcrypt password hashes.
Should I change my password after the Minehut breach?
Yes, on Minehut if you still use it and on any other site where you used the same password. Then turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
