Long story short; don't know how he got acces. e-mail was dutch (had minecraft and nl in it) What I find suspicious is that I host the VPS with a dutch company who mainly focus on minecraft.
Can't assure that though. I know the guys email and can probably get IP if I wanted to (just see who made connection to the vps)
I know one of the main bot nets currently silent mining monero scans for default telnet credentials so I would make sure that all of your defaults are changed. Also make sure that the kernal is completely updated as a given because linux is being hit pretty hard with new bugs and exploits so new patches are coming every couple of days especially within these last few weeks so I would do a dist-upgrade along with regularly if possible especially since you havea lot of users accessing it. And if you can implement SSL that would be ideal as well, but I am not to sure with how theminecraft clientworks.
Essence in the mist, that is the shadow with the grip.
Post your hosting provider's name so everyone else can see it. Also consider googling that company's name and "cryptocurrency mining" to see if the company may have done it themselves.
Also, read the TOS and see if it makes any mention of mining software.
