Nearly 7 Million Minecraft Players in Sinking Lifeboats! Change Passwords Now!

Some players of the popular game Minecraft Pocket Edition are the latest victims of a data breach. However, unbeknownst to them, the breach actually occurred last year! Approximately 7 million users of the popular game had user names, email addresses, and passwords stolen, yet were not informed at that time.

The BBC reported that specifically the Lifeboat community’s servers were breached. Lifeboat provides servers for custom, multiplayer environments for the mobile versions of the game. In order to join the community, the players connect to a Lifeboat server, register a username with a password and email address.

However, although the company does not belief any misuse has occurred due to this incident, users of this version of Minecraft and those using any of the worlds hosted in the Lifeboat community should change passwords right away. When doing so, keep strong password rules in mind:

• Always have a minimum of eight characters in all online passwords
• Stay away from “dictionary” words and easy to guess phrases
• Don’t use personally identifying information in passwords, such as birthdates, names, addresses, etc.
• Include at least one special character and at least one number in each password
• Don’t reuse passwords on multiple online sites

A good tip for remembering passwords is to create one core password that consists of at least six characters and numbers. Then tack on two characters from the website you log onto to create a unique one for each account. For example, your core password could be “dX1W*” and you have an account on a website that starts with the letters “ba.” Your new password would become “badX1W*.” Another site you visit may start with “zo,” making your new password “zodX1W*.” Using this method, it is unlikely you will duplicate passwords on multiple sites.

Knowledge is power, especially in the hands of criminals. Having all this information available about Minecraft users will allow the creation of very specific and detailed phishing campaigns. Phishing is by far the preferred way to deliver malware that can steal information like credentials to online banking or shopping sites; encrypt the computer and hold it for ransom; or any number of other terrible things. 

No Phishing Allowed:

• Never click on an unexpected link or open an unexpected attachment. If you receive a link or attachment from someone you know, verify that they sent it before you click. Malware can steal contact lists and send out more malware to the entire list without the owner knowing.

• Your financial institution will never send you a link or ask you for confidential information. If you want to go to any site that has your money or credit card information, open a browser and type the address manually or use a saved bookmark.

Lifeboat reportedly does not store personal information about the players that use its servers. Therefore, when the breach occurred, it determined that the best strategy would be to quietly force passwords to be reset for those users who were affected. Security researchers were not able to find anyone who was notified or who was forced to change a password. Take action to be proactive and do it anyway, if you play this game.