Leet data breach: 5.1M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2016-09-30
In August 2016, the service for creating and running Pocket Minecraft edition servers known as Leet was reported as having suffered a data breach that impacted 6 million subscribers. The incident reported by Softpedia had allegedly taken place earlier in the year, although the data set sent to HIBP was dated as recently as early September but contained only 2 million subscribers. The data included usernames, email and IP addresses and SHA512 hashes. A further 3 million accounts were obtained and added to HIBP several days after the initial data was loaded bringing the total to over 5 million. Exposed data: email addresses, ip addresses, passwords, usernames, website activity. The breach dates from Sep 10, 2016; Have I Been Pwned loaded it on Sep 30, 2016.
What to do
- If you had a Leet account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
