StreamCraft streamcraft.net StreamCraft data breach: what happened and what to do
In July 2020 the Russian Minecraft service StreamCraft was breached. HIBP added it in October 2024 and counts 1,772,620 accounts. Exposed: email addresses, IP addresses, usernames and passwords stored as MD5 or bcrypt hashes.
View all 13,115 breaches- Breach date
- 6 Jul 2020
- Affected
- 1,772,620
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
StreamCraft is a Russian Minecraft service. In July 2020 its user database was stolen. The file did not surface on its own at the time. It was later redistributed as part of a much larger corpus of leaked data, which is how Have I Been Pwned (HIBP) came to load it on 27 October 2024. HIBP counts 1,772,620 affected accounts, which matches the roughly 1.8M records its description mentions.
The wider collection that carried the StreamCraft data was covered by Cybernews, which reported on a compilation of billions of leaked credentials. Many of the records in a collection like that are years old and were recycled from earlier incidents. StreamCraft is one of those older ones, so the leak is dated 2020 even though it only became widely searchable in 2024.
What was exposed
HIBP lists four kinds of data for this breach: email addresses, IP addresses, passwords and usernames. The passwords were not stored in plain text. According to HIBP they were hashed with either MD5 or bcrypt. That difference matters a lot. MD5 is old and fast, so a criminal with a leaked list can guess common passwords against it quickly and recover many of them. Bcrypt is deliberately slow and much harder to crack in bulk, though a weak or common password can still fall.
IP addresses are the unusual item. An IP address can hint at roughly where someone connects from, and combined with an email address and a username it makes a profile that is easy to match against other leaks.
What that lets criminals do
The main risk here is password reuse. If you used your StreamCraft password anywhere else, a criminal can try the same email and password pair on other sites, an attack called credential stuffing. Email addresses also end up on phishing lists, so expect more junk mail and the occasional message that tries to look like a game or account notice.
Because the data is from 2020, the biggest dangers are the accounts you still use today that share an old password or email.
How old leaks still cause harm
A 2020 leak sounds stale, but old credentials keep working when people never changed them. Criminals sell and trade these lists for years, and automated tools test them against new sites every day. A password you set in 2020 and still use for email or shopping is as exposed today as it was then. Check whether you have reused a gaming password on anything that holds money or personal details, and fix those first.
The company's response
HIBP's entry does not link to a statement from StreamCraft, and the sources it cites for the breach are news coverage of the larger collection, not a notice from the service itself. No company announcement, regulator filing or settlement is public for this incident, so there is no free monitoring offer or official guidance specific to it.
What to do if you were in it
- 1
Change the password, and every place you reused it
If you ever had a StreamCraft account, change that password and any other account that used the same or a similar one. A password manager makes it practical to use a different one everywhere.
- 2
Turn on two-factor login
Add an authenticator app or security key to your email, banking and main social accounts. That blocks most credential stuffing even if an old password has leaked.
- 3
Expect phishing to your email
Treat unexpected messages about game accounts, purchases or logins as suspect. Don't click links in them. Go to the site directly instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases and the dark web for your email and phone number and tells you which leaks include them, so you know which passwords to change first.
Frequently asked
Was I affected by the StreamCraft breach?
Search your email address on Have I Been Pwned. HIBP lists 1,772,620 affected accounts. If your email is there, assume the username, IP address and password hash were taken too.
What was exposed in the StreamCraft breach?
Email addresses, IP addresses, usernames and passwords stored as MD5 or bcrypt hashes. HIBP lists no names, phone numbers or payment details.
Should I change my password?
Yes, if you used a StreamCraft password anywhere else. MD5 hashes in particular are quick to crack, so assume weak passwords are known.
When did the breach happen?
July 2020. The data was only added to HIBP on 27 October 2024, after it appeared in a larger collection of leaked records.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
