Breach Disclosure: Minehut

In May 2019, Minehut, a popular Minecraft server website suffered a data breach. The breach impacted all users of Minehut, which resulted in complete deletion of all player servers, as well as 397,000 email addresses gathered from a backup stored by Minehut.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

There is no indication in the posting by Minehut as to how the site was initially compromised, and the original forum post by Minehut has since been removed. While no personal or account data for the server was deleted, the attackers were able to take the 397,000 email addresses from a backup.