Items got removed from my hotbar

I'm asking staff to see what was going on.

Carol is correct in that moderators cannot do what you described. Senior staff and Admins can, but they should have put the items back if they messed with you and they don't make a habit of trolling players without making it obvious and they would make sure you were into it for fun. This definitely sounds weird to me so I'm investigating.

So we figured it out...let's just say someone had a joyride with Aikar's acct...

We're investigating any and all aspects of the incident, but it only applied to his game acct and not the site.
Please send a list of any missing items with details to https://pmss.emc.gs and we will work toward replacing them.

Goes to show how important 2 factor authentication is for accounts. Sadly even with unique passwords that wasn't shared anywhere or even similar to any password, the fact Minecraft didn't have any brute force prevention in place, someone was able to keep trying until they figured it out.

Sadly Mojang has not finished giving 2FA to all MC players yet.

I'm in the process of regaining access, so yes my account is banned for now. meme it up

yep, and talking some people in my communities, apparently it's happening to a lot of people. Guess the bad guys have figured out mojang has no protection for this.

No that was them, but I checked logs from both times they were on, and thankfully did not do really much at all beyond teleporting to some people and a few worldedit commands to set tnt and drain (im sure they were sad to see TNT didn't blow up the vanilla way )

most they did with emc's commands is spawn a giant.

a suggestion for everyone is to update your passwords to be really long, 20+ characters, with special characters, mixed case and numbers, to make it really hard to brute force.

Sadly I dropped the ball in not using a super complicated password so that I could remember it and manually type it in, but guess it'll be copy and paste only from here.

Well now if someone gets your keypass file, they know how to open it

Correct, they didn't seem to know anything about EMC's special features, as otherwise they would have abused them (promos, rupees, etc). Doesn't even look like they tried to op any of their other accounts, just opped some random players who were online and then deopped them.

As for why I was targeted, I am constantly emailed about my minecon capes, cape accounts are high value targets, so i'm sure it was just people trying to steal cape accounts, and they likely googled me to find a server they might have op on and found EMC.

Also just wanted to state ahead of time, ingame access has no access to sensitive information. Forum password is absolutely different, and has 2 factor auth.

I don't even really have anymore powers than Senior Staff other than the ability to create Supporter vouchers (admin only thing).

We make staff use square for most stuff, so in game access is pretty limited. And even if they used creative to spawn in diamonds, I'm sure i've done worse in my drop parties haha.

So absolutely no information was accessed, just the trolling they did in game.