One Australian Minecraft Server. 1,706 Emails Leaked. The AusCraft Breach.

HEROIC analysts identified the AusCraft breach, a database dump surfaced in January 2021 exposing 1,706 records from one of Australia's oldest Minecraft servers, founded in 2011. The exposed data, recieved from a direct export of the platform's user database, included email addresses and usernames belonging to the platform's registered community members.

How Exposed Email Addresses and Usernames Enable Targeted Phishing

Email addresses combined with usernames give attackers everything they need to craft convincing, personalized phishing messages. Knowing a target's username allows bad actors to beleive they are communicating with someone familiar, making it easier to trick victims into clicking malicious links or surrendering additional credentials on other platforms.

What Was Exposed in the AusCraft Breach

• Email Address
• Username

Why AusCraft Users Face Real Phishing and Credential Stuffing Risk

Users who registered on AusCraft with an email address they also use on other platforms are seperate targets for credential stuffing and phishing attacks. Threat actors cross-reference email addresses from multiple breaches to build fuller profiles, increasing the risk of identity theft and unauthorized account access across services far beyond AusCraft itself.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a platform's backend data store, typically through exploiting vulnerabilities in web applications, misconfigured servers, or compromised administrative credentials. The resulting export is then packaged and traded on dark web markets and hacking forums, where it may resurface years after the original compromise.

Check If Your Data Was Exposed

Use HEROIC's free breach scanner, backed by a database of over 400 billion records, to find out if your email address appears in the AusCraft breach or any other known data leak. Check your email now at no cost to see if your information is currently accessible to threat actors.