[Security] Data Breach and Information Leak

It is with great displeasure that I regret to inform you that in the days prior to the US server migration we suffered a breach into the Shotbow servers.

The attacker gained access using well-trusted credentials that were accidentally leaked through a third-party breach. These credentials granted access to most of the Shotbow infrastructure, including files stored on Shotbow servers and access to the database.

Our developers worked around the clock to shut down any compromised avenues of attack after the breach became known. We additionally moved the US server migration forward to best cut off any additional opportunities of attack.

Situations such as this one are unfortunate, but a reality in the Information Age.

While we have not yet seen any evidence of this information being leaked online, the following information is possessed by the attacker:

• Usernames
• One-Way-Hashed Shotbow.net Passwords
• IP Addresses
• Forum Information

Any payment information would have been performed through Buycraft, which is hosted and run by a third party and so would not be part of the breach.

While we do not believe Shotbow.net passwords are at any risk overall - them being secured with the best form of one-way hashing available to us - it is general security protocol to advise you to change this password wherever you may have used it. It is always recommended to use a different password on Shotbow.net Forums than you would anywhere else. It is a particularly good idea to ensure that your Shotbow.net password is different from your Mojang password in the event of information leaks from either source.

This breach and the subsequent migration gave us ample opportunity to upgrade our security protocols to the latest in industry best-practices, and we are committed to reviewing and improving these practices over the coming months and years.

Thank you for your loyalty. We will be happy to answer any questions or concerns you may have about this incident.

We will be sending an email about this shortly to all registered Shotbow.net players.

Wow, very shocked!

Only the forum password.

They do not have your Mojang password. They have a one-way encrypted version of your forum password. (They cannot easily take this encrypted version to find your actual password).

Calm down, it will be fixed soon I guess.

This is an unfortunate bit of news however it is important to remember that this can happen to any organisation, no matter how large. Thank you to those who spent their day and night correcting the vulnerability and I'm glad to hear that it has helped the network to increase its security.

If you're concerned about your IP, you may find the following link helpful: Here.

We are not at liberty to talk about potential ongoing investigations.

I've posted a short version of it in a dutch translation. Check it here: https://shotbow.net/forum/posts/2775049/.

True, but I think they are not targetting our IPs.

Lol xd