Minehut Breach Exposes 396,533 Email Addresses and Password Hashes
What Happened — In May 2019 the Minecraft server‑hosting platform Minehut disclosed that an attacker had obtained a database backup. The breach released 396,533 user email addresses together with bcrypt password hashes, which were later posted to Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous monitoring and encryption of backup data – a core control‑objective for credential protection.
- Shows why robust identity‑and‑access policies around privileged backup storage are essential for a defensible audit trail.
- Aligns with Verisq’s Access Controls capability, enabling organizations to collect evidence that backup handling meets control‑assurance requirements.
Who Is Affected — Gaming‑as‑a‑service providers, cloud‑hosted SaaS platforms, and any organization that stores user credentials in backups.
Recommended Actions —
- Verify that all backups are encrypted at rest and protected by strict access controls.
- Rotate compromised passwords and enforce multi‑factor authentication for privileged accounts.
- Document backup security controls and collect evidence for audit readiness.
Source: Have I Been Pwned – Minehut breach
Technical Notes — Exposed data: email addresses and bcrypt password hashes. The breach stemmed from unauthorized access to a database backup, indicating a misconfiguration or insufficient protection of backup storage.