Minehut minehut.com Minehut data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In May 2019, the Minecraft server site Minehut lost a database backup. About 397,000 email addresses were exposed, and a later data set also included bcrypt password hashes. Have I Been Pwned added it in September 2019.
View all 13,118 breaches- Breach date
- 17 May 2019
- Affected
- 396,533
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In May 2019, Minehut, a website that hosts Minecraft servers, suffered a data breach. The company said a database backup had been obtained, and it told the affected users afterwards.
About 397,000 email addresses from the incident were provided to Have I Been Pwned (HIBP), the free breach-tracking service. A second data set, which paired email addresses with bcrypt password hashes, was handed to HIBP later. Bcrypt is a slow hashing method built to make stolen passwords hard to crack, but short or common passwords can still be guessed.
What was exposed
Email addresses and passwords (as hashes). No other data types are listed in the HIBP entry.
An email address tied to a gaming account is enough for phishing that mentions Minecraft or server hosting. If you used the same password on other sites, a cracked hash can open those accounts too, which is how most of the real damage from a breach like this happens.
What Minehut did
Minehut told the users it identified as affected. The sources linked below don't describe further steps, so check your inbox (and spam folder) for any notice from the company.
If you had a Minehut account in 2019, treat the password as known and change it wherever you still use it.
Sources checked: haveibeenpwned.com, minehut.com
Last verified against the official page:
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on Minehut. If you used the same password anywhere else, change it there too, ideally with a password manager that generates a different one for each site.
- 2
Turn on two-factor login
Add an authenticator app or security key to your email, banking and shopping accounts first. A stolen password alone then won't get anyone in.
- 3
Expect phishing that mentions the breach
Emails and texts that quote your Minehut account, or claim to be from the company, are a common follow-up. Don't click links in them: go to the site directly instead.
- 4
Check whether your email is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number, and get an alert if a new one turns up.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Minehut data breach?
If you had a Minehut account in May 2019, possibly. HIBP lists about 397,000 email addresses from this breach. Searching your email on Have I Been Pwned or running a free Serus scan shows whether yours is among them.
What was exposed in the Minehut breach?
Email addresses and passwords. A later data set held email addresses with bcrypt password hashes.
Should I change my password after the Minehut breach?
Yes, on Minehut if you still use it and on any other site where you used the same password. Then turn on two-factor login.
Sources
- Have I Been Pwned: Minehut
- Have I Been Pwned: Minehut Data Breach · haveibeenpwned.com
- Free Minecraft Server Hosting · minehut.com
Something wrong or out of date? Tell us and we'll re-check it.
