Right now
- Change the website password (Forgot password if you are locked out). This also changes the panel password.
- Remove unknown subusers in every server's Users tab.
- Rotate secrets the attacker could have read: bot tokens in
.env, database passwords, RCON passwords, API keys of plugins. - Check the servers: were files deleted, plugins added, OPs granted?
ops.json,plugins/, and the console history tell. - Tell us in a ticket with the time you noticed. We look at the login history on our side.
What we can restore
Anything that is in a panel backup. A server deleted from the dashboard is gone together with its files, so ask us immediately. The sooner we know, the more we can still do. Balance an attacker spent is looked at case by case once the takeover is confirmed; write it in the ticket.
How it usually happens
Not by hacking us: a reused password from another site's leak, a token pasted in a public Discord, a "free capes" phishing link, or a friend with your login who is no longer a friend. Unique passwords in a password manager plus 2FA stop nearly all of it.