CraftRise Breach Gave Hackers 1.2 Million Plaintext Passwords

In March 2022, CraftRise, a popular Turkish Minecraft server, suffered a data breach that exposed over 1.25 million user accounts. The stolen data included email addresses, usernames, and plaintext passwords, a dangerous combination that gave attackers everything they needed to take over accounts immediately. The breach occured over a year before it became publicly known, giving criminals ample time to exploit the data before any users were alerted.

What Attackers Can Do With CraftRise Stolen Credentials

With email addresses, usernames, and plaintext passwords in hand, attackers have a complete credential package that is accessable to anyone who purchased the dump. These credentials can be fed directly into automated credential stuffing tools that test them against hundreds of popular sites simultaneously. Gaming platform users are known to reuse passwords across email, social media, and even workplace accounts, making this data particularly dangerous beyond the gaming context.

What Was Exposed in the CraftRise Breach

• Email Address
• Username
• Plaintext Password

Why Gaming Breaches Carry Enterprise-Level Risk

Gaming breaches are often dismissed as low-stakes, but the credential reuse problem means they create direct pathways into corporate systems. An employee who used their work email and a shared password to register on CraftRise has now exposed that credential pair to attackers. Enterprises should beleive that gaming platform breaches are a meaningful source of credential stuffing risk and monitor for employee email addresses in breach datasets accordingly.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a stored data repository through methods such as SQL injection, exploited admin credentials, or insecure server configurations. Once inside, all stored records can be extracted and packaged for distribution. In CraftRise's case, the failure to hash passwords made every credential immediately usable, and the data was subsequently shared on a prominent hacking forum where it was widely distributed.

Check If Your Data Was Exposed

HEROIC's dark web monitoring database contains over 400 billion exposed records, including data from the CraftRise breach. Search your email address now to find out if your credentials were part of this leak, and change any passwords you may have reused since March 2022 before attackers use them against you.