Hackers claim to have 18 million Minecraft player records for sale on the dark web

Several cybercriminals claim on dark web forums to hold extensive data on Minecraft players and have offered it for sale to the highest bidder.

One seller claims to have 18 million records, while a second post puts the figure at 9 million.

Following the alert, Cybernews researchers examined free samples containing around a thousand records provided by the attackers themselves.

The analysis revealed that the exposed records contain usernames, email addresses and, in some cases, password hashes.

The analysts found that some of the data appeared across multiple profiles and determined that the information came from at least three specific Minecraft servers. They therefore ruled out an intrusion into Mojang Studios' or Microsoft's central servers.

The presence of these email addresses in databases such as Have I Been Pwned also suggests that the data was harvested in bulk using infostealer malware.

The leak has prompted cybersecurity experts to question the claimed size of the dataset offered for sale. According to the Cybernews researchers, "it is unclear how old the dataset is, as there are no timestamps".

They added that "there is also no way to tell whether it really contains 18 million or 9 million records based solely on the sample".

How were users infected?

The main hypothesis how users became infected points to malicious modifications or add-ons integrated into the platform itself.

The experts say that "the listing examined appears to come entirely from multiplayer servers, so there may have been malicious mods on the server side". While they note that this type of harmful software is a recurring problem in gaming, they acknowledge that, in this case, it is impossible to attribute the leak to any particular mod.

So far, Microsoft has neither issued an official statement nor commented publicly to confirm or deny the incident.

Meanwhile, the main threat to affected Minecraft players is credential stuffing: attacks in which cybercriminals test the leaked email and password combinations on other online services, exploiting password reuse.

Several cybercriminals claim on dark web forums to hold extensive data on Minecraft players and have offered it for sale to the highest bidder.

One seller claims to have 18 million records, while a second post puts the figure at 9 million.

Following the alert, Cybernews researchers examined free samples containing around a thousand records provided by the attackers themselves.

The analysis revealed that the exposed records contain usernames, email addresses and, in some cases, password hashes.

The analysts found that some of the data appeared across multiple profiles and determined that the information came from at least three specific Minecraft servers. They therefore ruled out an intrusion into Mojang Studios' or Microsoft's central servers.

The presence of these email addresses in databases such as Have I Been Pwned also suggests that the data was harvested in bulk using infostealer malware.

The leak has prompted cybersecurity experts to question the claimed size of the dataset offered for sale. According to the Cybernews researchers, "it is unclear how old the dataset is, as there are no timestamps".

They added that "there is also no way to tell whether it really contains 18 million or 9 million records based solely on the sample".

How were users infected?

The main hypothesis how users became infected points to malicious modifications or add-ons integrated into the platform itself.

The experts say that "the listing examined appears to come entirely from multiplayer servers, so there may have been malicious mods on the server side". While they note that this type of harmful software is a recurring problem in gaming, they acknowledge that, in this case, it is impossible to attribute the leak to any particular mod.

So far, Microsoft has neither issued an official statement nor commented publicly to confirm or deny the incident.

Meanwhile, the main threat to affected Minecraft players is credential stuffing: attacks in which cybercriminals test the leaked email and password combinations on other online services, exploiting password reuse.

Become a premium member for free!