We, Craftigames B.V., the company behind PikaNetwork and JartexNetwork, want to inform our community about a security incident that was discovered on November 17th, 2024. Our investigation revealed unauthorized access to our internal system used to store user actions on both PikaNetwork and JartexNetwork through an Nginx vulnerability, which has since been patched on November 18th, 2024.
Important: The scope of this incident affects:
- All player actions and commands logged on both PikaNetwork and JartexNetwork since June 1st, 2023
- Players who voluntarily used the /email command after June 1st, 2023
- Cracked players who mistyped the /login command (like typing /lgin)
- Premium (original Minecraft) players are not affected as they don't use /login
What's crucial to understand:
- All in-game actions and commands used by players since June 1st, 2023 were exposed on both networks.
- The hackers cannot verify if any email address was actually verified or linked to any Minecraft account
- For cracked accounts: they could only see mistyped login attempts (like /lgin), not correct /login usage
- There is no way to link Minecraft usernames to real identities
- Most of our players are not affected unless they specifically used the /email command after June 2023
- Regular logins using the correct /login command were never logged
Actions we've taken:
- The security vulnerability has been fixed on both networks
- We've completely disabled logging of login-related commands
- All historical logs of email and mistyped login attempts have been removed
- We've reset passwords for all accounts where mistyped login attempts were logged
- We've implemented additional security measures
- We've reported this incident to relevant authorities
What you should know:
- This only affects our Minecraft servers, not any other services
- If you never used the /email command, your personal information was not exposed
- If you're a premium player, your account is not at risk
- If you're a cracked player who had any mistyped login attempts, your password has been reset for security
Important for affected players:
- If you can't login anymore on either PikaNetwork or JartexNetwork, this means your password was reset for security reasons
- You can request a new password through the forums on either PikaNetwork or JartexNetwork
- Be cautious of any suspicious emails claiming to be related to your Minecraft account
We will directly contact players who have verified email addresses in our system. If you have any concerns or questions, please reach out to us at info@craftigames.net. We value your privacy and security, and we're committed to maintaining the trust you place in our services.