More Than 1,800 Minecraft Usernames, Passwords Leaked

[John Doe]

Well villuns, apparently these are just German accounts at the moment but this could just be the tip of the iceberg. It might be wise to consider changing your Minecraft password to protect yourself before your account gets hacked.

JD



http://www.tomshardware.com/news/pasteb ... 28427.html



A report issued by German website Heise stated that hackers have managed to steal the passwords and login email addresses of more than 1,800 German Minecraft accounts. This information now resides in plain text on Pastebin, allowing anyone to access the compromised accounts and download the $27 game for free.

With a user base of more than 100 million PC gamers, the number of compromised accounts is rather small. How these accounts have been compromised is unknown at this point, but there's speculation that this could be just the beginning of something larger. The hackers may have even stashed away more Minecraft account credentials to "publish" at a later date.

"There is no mention of the security breach on Minecraft's homepage, but my recommendation would be that if users have any concern that their accounts might be exposed to hackers that they should change their passwords immediately," said security analyst Graham Cluley. "It goes without saying that they should be particularly concerned if they are using the same password anywhere else on the web."

Cluley also pointed out that with these email addresses in hand, hackers will not only know who is playing Minecraft, but they could spam these players with malicious game-related "patches" and links to fake, infected Minecraft sites. The information could also be used to access other non-Minecraft accounts as well, if players are using the same credentials.

Concerned Minecraft gamers are encouraged to change their login information immediately. Mojang provides tips for creating a good password right here.

News of the Minecraft breach follows an update by SplashData on Monday that lists the worst passwords of 2014. The top ten include "123456," "password," "12345," "12345678," "qwerty," "123456789," "1234," "baseball," "dragon" and "football." Other bad passwords include "superman," "batman," "111111," "trustno1," "123123" and many more. Web surfers are suggested to not use their birthday or favorite sport.

"The bad news from my research is that this year's most commonly used passwords are pretty consistent with prior years," said online security expert Mark Burnett. "The good news is that it appears that more people are moving away from using these passwords. In 2014, the top 25 passwords represented about 2.2% of passwords exposed. While still frightening, that's the lowest percentage of people using the most common passwords I have seen in recent studies."

Cluley's news update on Monday provided a partial view of the leaked Pastebin file, showing that the first twenty Minecraft gamers on the list aren't using basic passwords like "123456" and "superman," which is a good thing. Again, German Minecraft gamers who are concerned that their credentials could be served up on the Pastebin file should change their login information now.

So far, there's no word on additional leaked Minecraft credentials from other territories such as North America.

[Flash]

Thanks for the heads-up JD.

Change your Mojang account password here: https://account.mojang.com/me/settings

If you use something similar for your Steam password it is probably worth changing that as well.

[John Doe]

Looks like its not the end of the world, it would seem the accounts were hacked by phishing.

http://www.tomshardware.com/news/mojang ... 28444.html

Minecraft developer Mojang revealed on Wednesday how the usernames and passwords of 1,800 accounts were recently stolen. The studio reassured gamers that it wasn't hacked and instead blamed the theft on a phishing attack. Essentially, these Minecraft gamers were tricked into providing their usernames and passwords when directed to fake Mojang/Minecraft websites.

"If you haven't received an email from us, you don't need to worry. No one has gained access to the Mojang mainframe," Mojang reported. "Even if they did, we store your passwords in a super encrypted format. Honestly, you don't need to panic."

Mojang didn't go into detail about the phishing attack, but instead requested that Minecraft players use a unique password when logging into their account. That way, if Mojang does get hacked in the future, the crooks won't have access to other online accounts used by Minecraft gamers such as email and banking.

Microsoft, which purchased Mojang for $2.5 billion back in September 2014, indicated on Wednesday that there was no sign of foul play on the server side. However, the company admitted that it quickly reset the passwords of the affected Minecraft accounts after the published list of account info surfaced.

Mojang and Microsoft provided instructions on how to create a great password right here, noting that a good password should be easy to remember but difficult for hackers. Avoid using obvious phrases like a pet's name or a birthday. Passwords should also not only include a long line of numbers and letters, but at least one capital letter.

"You need to pick a really strong password, something that not even the most powerful computer can crack within a reasonable amount of time," Mojang stated.

[Inner]

Thanks for the update guys!