Early October brought the usual dark-web noise: two different sellers on cybercrime forums advertising Minecraft player records. One promised up to 18 million entries, the other a still-impressive 9 million. Both attached the same sample. Cybernews researchers downloaded it, ran the numbers, and immediately saw the hype deflate.
What the sample actually contained
- Exactly 1000 records duplicated across both sales posts
- Minecraft usernames, email addresses, and in some cases password hashes
- Data tied to only three distinct community servers
- Many of the emails already appear in Have I Been Pwned
No timestamps, no Mojang account tokens, no Microsoft login details. The researchers could not confirm the claimed total volume because the verifiable portion is tiny. Both sellers were apparently reselling the same recycled package and inflating the count for clicks.
PCGamesHardware followed up with its own fact-check on October 4 and reached the same verdict: the sample originates from third-party servers, not central infrastructure. No official statement from Mojang has appeared because there is nothing for them to patch. The threat is on the player side.
The pattern matches earlier 2026 malware campaigns that targeted Minecraft mod downloads and fake clients. Compromised machines quietly log in to servers, harvest credentials, and phone home. Those logs then surface on forums months or years later dressed up as a “mega-leak”.
What you should actually do
- Check your email on Have I Been Pwned
- Stop reusing passwords across Minecraft, Microsoft, and everything else
- Enable 2FA on your Microsoft account if it is not already active
- Avoid shady mod sources and "free client" downloads
The internet will keep shouting about 18 million hacked Minecraft accounts because the number sounds scary. The verified reality is far smaller, far older, and far more mundane. Change the passwords that matter and move on.
News
Other
