It's incredibly unlikely that the attackers just so happened to have a cbmhost users key on them. There are 2 scenarios that are tens of times more likely:
1. They only had a part of a key, and were not able to recover the rest because they didn't have the rest of the key.
2. They used an alternative method of extracting characters from the keydat, which didn't succeed in extracting all the characters. Not wishing to show that there were characters mising, the attackers only took a picture of the characters they had at the very end.
There is only one scenario in which situation 1 could possibly be true, and that scenario is that the persons responsible for this attack only had the last 3-4 characters of a key to use in this attack in the first case. What I mean is, since you need a known key to extract the encryption key from a key.dat file, the situation would have to be that they only had the last 4 characters of the known key so they were only able to extract the last 4 characters of the encryption key. Since obtaining the encryption key is the easiest part of the entire process, and the persons responsible could have just signed up for CBMHost, input one of their own keys, and then used the directory traversal attack to download their own key.dat and snag the encryption key.
2 is just impossible. XOR encryptions have 1 solution and ((256^length)-1) incorrect solutions, and there is no way to know which one is correct unless you can either generate the key itself or already know what it is. Since generation of the key uses hashes, you can't generate just part of the key. It's all or nothing. I just said what would happen if they had part of the key, but that seems really unlikely.
It is, in all likelyhood, that they have all the characters in the keys.
The reason the last characters of the keys are shown in the screenshot is obviously for bragging purposes. Whoever is responsible wanted people to know that they had keys, and they wanted it to be verifiable by the people who had the keys. The perpetrator literally just cropped a bunch of lines that were formatted like "KEY NAME BLID" to only show the end of the key but all of the name and BLID so that the owners could verify the keys without letting everyone have them.
They haven't been used for anything malicious because, contrary to popular belief, hackers are not just inherently bad people. Hackers hack for fun, there's a lot of fun in finding exploitations and exploiting them. There's also a lot of fun in trolling / fear mongering, and that's exactly what's going on here. The keys were stolen because they figured out a way how to steal them. They weren't stolen to blackmail people, they weren't stolen to resell, they were stolen as an act of terrorism against the Blockland community. Not to make a point though, just for the fun of it.
Everyone affected, there is no reason to change what key you are using unless given a reason to. By this I mean people impersonating you or joining your server to gain host permissions. That harassment is the worst that people can do to you with your key, other than getting it revoked. If either of that flares up, then I would personally move to an alternate key.
