Minecraft player data allegedly for sale on cybercrime forums

Threat actors on underground cybercrime forums are claiming to have access to massive datasets of Minecraft player records. One post alleges that 18 million records are for sale, while another claims 9 million.

Cybersecurity researchers investigating the claims found significant discrepancies. Analysis of the provided samples revealed that both datasets contained the same 1,000 records. The data includes usernames, email addresses, and some password hashes. However, the sample appears to originate from only three specific Minecraft servers rather than a centralized breach.

There is currently no evidence to confirm a breach at Mojang Studios or Microsoft. Researchers suggest the data may have been collected via infostealer malware, as the email addresses in the sample appear in existing breach databases and infostealer combo lists. The leaked information could potentially be used for social engineering or credential stuffing attacks.