Minecraft players’ data surface in alleged 18 million breach

Hackers claim to be selling nearly 20 million Minecraft player records. Could Russian malware distributed via GitHub be behind the alleged breach?

Two posts were uploaded on underground cybercrime forums, both claiming that Minecraft players’ data has been breached.

In one post, a threat actor is stating that 18 million user records are for sale, while the second one claims a more moderate number of 9 million records.

Created by Markus "Notch" Persson and developed by Mojang Studios, Minecraft has over 212 million monthly active players.

What’s inside the alleged Minecraft leak?

Cybernews researchers examined the samples posted alongside both claims and found that the supposedly different datasets appear to be the same 1,000 records.

The sample contains usernames, email addresses and, in some cases, password hashes. The records also appear to have been collected from specific Minecraft servers, with only 3 unique servers appearing across the sample.

Our researchers said the information could potentially be used for credential stuffing and social engineering scams, particularly if the email addresses are paired with passwords that victims have reused elsewhere.

“It is not clear how old the dataset is, as there are no timestamps,” the researchers said.

“There is also no way to say if these are truly 18 million or 9 million records based on the sample alone.”

The overlap in the dataset samples raises questions about whether the sellers are actually offering separate datasets or the same one.

What are the risks for Minecraft players?

Our researchers said the exposed data could potentially be used for credential stuffing and social engineering scams, particularly if the email addresses are paired with passwords that victims have reused elsewhere.

Criminals can use username-and-password combinations from previous breaches and try them on other services, gambling on users recycling their credentials across different platforms.

How was Minecraft player data exfiltrated?

It remains unknown what the attackers' entry point was or how they exfiltrated the data.

The sample contains usernames and emails, but some records also include password hashes. Our researchers noticed that some password hashes were repeated across various users.

The Cybernews research team found that email addresses in the sample appear in Have I Been Pwned and are referenced in multiple infostealer combo lists. This suggests that the data source may be infostealer malware.

Russian malware to blame?

In 2025, Check Point Research discovered 1,500 devices compromised by suspected Russian-origin malware designed to infect Minecraft players.

The malware has been disseminated through malicious GitHub repositories, disguised as Minecraft mods, cheats, or popular automation tools used within the Minecraft community.

The malware has been harvesting Minecraft players' credentials from web browsers, as well as data from cryptocurrency wallets and applications such as Discord, Steam, and Telegram.

That earlier campaign provides a plausible backdrop for the current claims, but it does not establish a connection between the incidents.

The data sample currently under examination appears to contain information gathered from specific multiplayer servers, prompting consideration of whether malicious modifications or compromised server infrastructure could have played a role.

Minecraft players’ devices were likely infected with infostealers

Minecraft has a vast ecosystem of mods, plugins, and custom servers, making the game a particularly fertile environment for both legitimate tinkering and malicious software.

“The listing we analyzed now looks like it originated purely from multiplayer servers, so there could’ve been malicious mods on the server’s side,” said Cybernews researchers.

However, data collected from the server side would typically expose information such as usernames, IP addresses, and connection times. Email addresses and passwords are harder to explain through ordinary server telemetry.

“Malicious mods are not a super unique incident that happens in the gaming community in general,” our researchers noted.

“We cannot pinpoint any specific mods here.”

The researchers say the data in the newly advertised sample looks more consistent with information assembled from infostealer combolists than with a straightforward breach of Minecraft's infrastructure.