In April, a listing appeared on dark-web marketplaces offering the database of Meloncraft, a Minecraft multiplayer server. Breach-monitoring outlet Brinztech flagged it as an alleged leak of 663,726 records. They appeared to come from LiteBans, the plugin many servers use to log bans, mutes and warnings. For players who had once joined the server, the worry wasn’t their ban history. It was what sat next to it.
What the Meloncraft leak allegedly contained
According to the listing as described by Brinztech, the dataset held player usernames, IP addresses and password hashes in the format used by AuthMe, a login plugin common on offline-mode servers, alongside punishment records. The leak hasn’t been independently confirmed, and the server hasn’t published a statement we could find.
If the data is real, two parts are dangerous. IP addresses can be used for doxxing attempts and DDoS attacks against players who host from home. Password hashes can be cracked when passwords are weak, and many players reuse the same password on other servers, and sometimes on their email.
Key facts
- Meloncraft (April 2026): 663,726 alleged records, including usernames, IPs, AuthMe-style password hashes and ban logs. It surfaced on dark-web marketplaces and hasn’t been independently confirmed.
- The “18 million” leak (October 2026): two sellers claimed 18 million and 9 million records, but both used the same 1,000-record sample.
- Verdict on the big one: Cybernews traced the sample to just three community servers. It looked like recycled infostealer data, not a Mojang or Microsoft breach.
October: the leak that wasn’t
Six months later came a much bigger headline. Two sellers on cybercrime forums advertised Minecraft player data, one claiming 18 million records and the other 9 million. Both posts included samples with usernames, email addresses and some password hashes. For a day it looked like the biggest Minecraft breach in years.
Then researchers at Cybernews downloaded the samples. Both sellers had attached the same 1,000 records, drawn from only three community servers. There were no timestamps proving the data was new and no Mojang account tokens or Microsoft logins, and many of the emails were already known from older breaches. The researchers concluded it matched infostealer “combolists”: credentials scraped from infected players’ PCs and repackaged with inflated numbers. German outlet PC Games Hardware reached the same conclusion. It was not a breach of Minecraft itself.
What it meant for players
The two stories point to the same risk: your Minecraft account is rarely hacked through Mojang. It’s lost through a third-party server’s weak database, or through malware on your own PC that steals what your browser has saved. The fix is the same for both.
- Use a unique password for your Microsoft account, never one you’ve typed into a server’s /login or /register prompt.
- Turn on two-step verification on your Microsoft account.
- Check your email on Have I Been Pwned, and change any password that shows up.
- If you host a server, keep LiteBans, AuthMe and your database off the public internet, use strong hashing and patch your plugins.
- Avoid cracked clients and random mods. They’re how infostealers fill those combolists. See our mod malware guide.
