You noticed a login you did not make, a plugin you did not install, or an operator who should not be one. Work in this order — it is arranged so that each step stops the situation getting worse before the next one investigates it.
First, close the door
- Change your panel password
From a page you navigated to yourself, not a link. This is first because everything else is reachable through it.
- Change it wherever you reused it
Especially your email. An attacker with your email can undo the password change you just made.
- Remove every subuser you do not recognise
And every one you do recognise but did not add recently. Add them back afterwards if they were legitimate.
- Stop the server if damage is ongoing
A stopped server cannot be damaged further, and the world on disk stops changing. This buys you time to think.
Then, find out what happened
- Read the activity log from before you noticed
Work backwards to the first login you cannot account for. That is your starting point, and everything after it is suspect.
- Check Startup and Settings for changes
A changed startup command or jar is how persistence gets added. Compare against what you remember configuring.
- List operators and permissions
ops.jsonand your permissions groups. An added operator is the most common change and the easiest to miss. - Look at the plugins folder by modification date
Anything added or changed at a time you were not working is worth examining before the server runs again.
Then, rotate everything the server knew
- Database passwords
They sit in plugin configs in plain text. Anyone with file access has them.
- RCON, if it is enabled
And consider whether you need it enabled at all.
- Any bot tokens or API keys in configs
A Discord bridge token in a config file is a Discord bot somebody else now controls.
If they had your password, they still have it after a restore. Rotate credentials first, restore second. A restore that puts a clean world behind an unchanged password is a delay, not a fix.
Dates, what changed, what you rotated. In two weeks you will want to know whether you already changed a particular password, and «I think so» is not an answer you can act on.