Aternos aternos.org Aternos data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In December 2015, the free Minecraft server host Aternos was breached, affecting about 1.4 million subscribers. Usernames, email addresses, IP addresses and hashed passwords were exposed.
View all 13,118 breaches- Breach date
- 6 Dec 2015
- Affected
- 1,436,486
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames, Website activity
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Aternos is a service for creating and running free Minecraft servers. In December 2015 it suffered a data breach that affected about 1.4 million subscribers. Have I Been Pwned (HIBP), the breach notification service run by Troy Hunt, added the data to its collection in October 2016.
What was exposed
HIBP lists five types of data: email addresses, IP addresses, passwords, usernames and website activity. The passwords were hashed, which means they were scrambled rather than stored as plain text. Hashing slows attackers down, but weak or common passwords can still be guessed from a hash.
What it lets criminals do
An email address plus a username is enough to send a convincing phishing message to someone who played on Aternos. IP addresses give a rough location. The bigger risk is password reuse: if you used your Aternos password on another account, someone holding the hash may try to crack it and test the result elsewhere.
The company's response
HIBP's entry links to a post from the official Aternos status account about the incident. We don't have more detail on the company's response than that.
The breach is nearly a decade old, so the practical question is whether the password you used then is still in use anywhere. If it is, change it today.
Sources checked: haveibeenpwned.com, twitter.com
Last verified against the official page:
What to do if you were in it
- 1
Change any password you shared with Aternos
If you reused your Aternos password anywhere else, change it on every one of those accounts. Use a different, long password for each.
- 2
Turn on two-factor authentication
Turn on 2FA for your email and any account that matters, so a guessed password alone isn't enough to get in.
- 3
Expect phishing that mentions Minecraft
Treat messages about your server, account or game with suspicion, and go to the site directly instead of clicking links in an email.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the steps here are what protect you.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Aternos data breach?
If you had an Aternos account in December 2015, possibly. You can search your email address on Have I Been Pwned, or run a free Serus scan.
What was exposed in the Aternos breach?
Email addresses, IP addresses, passwords, usernames and website activity. HIBP says the passwords were hashed.
Should I change my password?
Yes, if you still use that Aternos password anywhere. Pick a new unique one for each site.
Sources
- Have I Been Pwned: Aternos
- Have I Been Pwned: Aternos Data Breach · haveibeenpwned.com
- Aternos Status on X: "Yes, we got hacked. No, we don't give up." / X · twitter.com
Something wrong or out of date? Tell us and we'll re-check it.
