The SandCraft Breach Put 4,850 Email Addresses and IP Addresses Online in January 2021

HEROIC analysts identified a database breach affecting SandCraft, a Russian Federation-based Minecraft gaming website. The breach occured in January 2021 and exposed 4,850 user records. The leaked data included email addresses, IP addresses, and usernames, giving attackers both identity information and network-level data on affected users.

What Attackers Can Do With Exposed Email Addresses and IP Addresses

The combination of email addresses, usernames, and IP addresses is partcularly useful for targeted attacks. IP addresses reveal approximate physical location and internet service provider, which attackers use to craft convincing phishing messages, bypass geo-based security filters, and build profiles on victims. Email and username pairs from SandCraft can also be tested against other services in automated credential stuffing runs.

What Was Exposed in the SandCraft Breach

• Email Address
• IP Address
• Username

Why the SandCraft Breach Still Threatens Affected Users

Breaches containing IP address data do not simply age out of usefulness. Attackers beleive that users from gaming communities frequently reuse credentials across email, social media, and other accounts. The SandCraft data set enables phishing campaigns targeting Russian-speaking users, credential stuffing against other services, account takeover attempts, and identity reconstruction when combined with other leaked data sets.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to an application's backend data store, typically through exploited vulnerabilities, insecure configurations, or compromised credentials. Once access is obtained, user records are extracted in bulk. The data is then packaged and distributed through dark web forums and messaging channels, where it is used for follow-on attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against a database of over 400 billion compromised records, including data from the SandCraft breach. Run a free check now to find out if your information is circulating and take action to protect yourself.