We want to inform our users about a security incident affecting part of the infrastructure used by PikaNetwork.
What happened?
On August 17 and 18, 2026, an unauthorized third party gained access to several systems within our gaming infrastructure.
The attacker made use of compromised access to an internal management system, after which malicious software was placed on multiple Minecraft game servers. On two affected servers, the attacker subsequently obtained full administrative access.
We became aware of the incident after compromised administrator accounts were used to send messages in our in-game chats stating that our systems had been hacked. Members of our team were online at the time and responded immediately. Within approximately five minutes, the affected systems were taken offline and a technical and forensic investigation was started.
What information may have been affected?
Our investigation indicates that the attacker searched files and system configurations for credentials and database information.
On one affected server, commands were executed that could be used to read the complete contents of the server's filesystem. We are unable to determine with certainty which information was actually transferred or obtained by the attacker. As a precaution, we are therefore treating information accessible through the affected systems as potentially compromised.
Potentially affected information includes:
- Minecraft usernames
- Minecraft UUIDs
- IP addresses
- Timestamps and technical account information
- Hashed authentication data (passwords stored as salted password hashes, not in readable form)
- Moderation and sanction records
- Chat and server logs containing Minecraft usernames and IP addresses
An account password is only used by cracked (non-premium) accounts. Premium (original Minecraft) accounts do not require a password on our servers, so no password of theirs could be affected. Passwords stored in our authentication database were protected using salted password hashes and were not stored there in readable form.
What should you do?
This section applies to cracked accounts only, as premium accounts do not use a password on our servers. As a precaution, if you used the same password on PikaNetwork as you use on any other website, game, email account or service, we strongly recommend changing that password on those other services.
We also recommend using a unique password for each service.
The authentication credentials used on our Minecraft servers do not themselves provide access to external services. The additional risk exists only where a user has independently reused the same password elsewhere.
What information was not stored?
The affected Minecraft user-registration environment does not normally contain information such as:
- Real names
- Residential addresses
- Dates of birth
- Identity documents
- Government identification numbers
- Payment card information
We also do not have an email address or other direct contact method for the majority of our Minecraft users. Minecraft usernames are not directly linked by us to a user's real-world identity or age.
What have we done?
Immediately after discovering the incident, we isolated the affected systems and started a technical and forensic investigation.
Measures taken include:
- Removing unauthorized access, malicious files, backdoors and other persistence mechanisms
- Revoking and replacing potentially compromised system credentials
- Changing affected database credentials
- Closing the vulnerable access route
- Patching the security vulnerability used to obtain elevated server privileges
- Rebuilding affected servers where necessary
- Increasing active monitoring for suspicious activity
- Introducing stricter authentication and authorization checks on publicly accessible API endpoints
- Improving the frequency and speed of security updates and patching
- Implementing additional periodic security reviews and monitoring
Our investigation is still ongoing and further measures may be taken if additional relevant information becomes available.
Notification to the Dutch Data Protection Authority
We have reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) as a personal data breach.
The report is currently based on the information available from our ongoing technical and forensic investigation. If material new information becomes available, the report may be supplemented accordingly.
Why are we publishing this notice?
The accounts on our servers have been created over a period of approximately ten years. We do not have email addresses, telephone numbers or other direct contact details for the majority of users, and many historical accounts are no longer active.
It is therefore not practically possible to contact every potentially affected user individually. We are publishing this notice on our website and communicating it through our official Discord communities in order to reach as many current and returning users as reasonably possible.
Contact
If you have questions regarding this incident or the information associated with your Minecraft account, please contact security@craftigames.net.
We will update this notice if our ongoing investigation produces material new information.