249K Forum 4 iCrafts Credentials Exposed in Security Breach

HEROIC's DarkHive intelligence system discovered the Forum 4 iCrafts su breach, exposing 249,258 records from the Russian Minecraft crafting community forum that was compromised in February 2015. The breach included usernames, email addresses, and MD5-hashed passwords from forum4icrafts.su, a community hub for players interested in Minecraft building and crafting. With nearly 250,000 accounts affected, this breach has been a persistent source of leaked credentials circulating in underground data markets.

Why This Is Dangerous

Minecraft community forums attract users who are often active across multiple gaming platforms including Steam, Minecraft multiplayer servers, game modding sites, and gaming-related Discord servers. When credentials from a Minecraft forum are compromised, attackers can use them in credential stuffing attacks against a wide range of gaming services where the same email and password combination may have been reused. MD5 hashing, while not storing passwords in plaintext, is a weak algorithm by modern standards and can be reversed for a significant portion of passwords using GPU-based cracking tools and precomputed rainbow tables.

What Was Exposed

• Usernames
• Email Addresses
• MD5-Hashed Passwords

Why This Matters

The Forum 4 iCrafts su breach data has appeared in multiple underground data compilations and Telegram channels where threat actors distribute credential lists for use in automated account takeover attacks. Minecraft community accounts from Russian-language forums are commonly tested against Russian social media platforms, email providers, and online gaming services where reused credentials can provide unauthorized access. The long-tail nature of this data means it continues to be incorporated into new credential compilations years after the original breach, extending the risk indefinitely for users who have not changed their passwords.

How Database Breaches Work

A database breach occurs when attackers exploit vulnerabilities in a website's web application code, database configuration, or server infrastructure to gain unauthorized access to the stored user data. Community forums running on platforms like phpBB, vBulletin, or MyBB are common targets because they often run outdated software versions with known vulnerabilities. Once the forum database is accessed, attackers extract the user table containing registration data and password hashes, then distribute the data through underground markets. MD5-hashed passwords can be cracked efficiently with modern tools, converting the hashed values back into usable plaintext credentials for stuffing attacks against other services.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the Forum 4 iCrafts su breach. Visit heroic.com to check if your information was exposed. If you participated in the iCrafts forum before 2015 and reused that password elsewhere, updating your credentials across all affected platforms is strongly recommended.