LinkedIn data breach: what happened and what to do

LinkedIn's best-known breach has two dates. The hack happened in 2012. The data surfaced four years later, in May 2016, when a seller offered it online. If you had an account back then, both dates matter.

What happened

In 2012, LinkedIn said some members' passwords had been stolen. It forced a password reset on the accounts it believed were affected and told everyone to change their passwords. At the time it put the number of passwords involved at about 6.5 million.

In May 2016 a seller going by the name "Peace" offered a much larger set of email and password combinations for about 5 bitcoin. LinkedIn said it had learned of a further data set from the 2012 theft. It invalidated the passwords of affected accounts and contacted those members to reset them. It said it had no indication of a new breach. Have I Been Pwned (HIBP) loaded the data and counts 164,611,595 email addresses.

What was exposed

HIBP lists two things: email addresses and passwords. The passwords were stored as SHA1 hashes without salt. That's a weak setup. Identical passwords produce identical hashes, so attackers can crack the common ones in bulk. HIBP notes that the vast majority were cracked within days of the data's release.

What it lets criminals do

The main risk is credential stuffing: trying a leaked email and password pair on other sites. LinkedIn used your email address as the login, and plenty of people reuse passwords, so a 2012 password could open a different account years later. A cracked password also makes phishing more targeted, because the attacker can quote something you really used.

An email address on its own is mostly a spam and phishing risk. LinkedIn is a work account too, so scam messages posing as recruiters or connection requests are a common follow-up.

The company's response

LinkedIn invalidated the passwords it found in the 2016 set and emailed affected members to reset them.

If you had an account in 2012

You've almost certainly changed your LinkedIn password since. The real question is whether you used the same one anywhere else. If you did and haven't changed it, do that now.

Why a 2012 breach still matters

Old password data doesn't expire. Criminals keep big lists of leaked email and password pairs and try them on new targets. A password you set in 2012 can still be tested today against a bank, a shop or an email account. The cracked LinkedIn set is one of the most widely circulated of those lists.

Two habits close most of the gap. Use a different password on every site, so one leak can't open the next account. And turn on two-factor login for your email, since email resets every other account. A password manager makes the first habit painless.

Reading the numbers

You'll see different figures: 6.5 million, 117 million, 164 million. They describe different things. The 6.5 million is what LinkedIn confirmed in 2012. The larger figures describe the data that appeared in 2016. HIBP's 164,611,595 is the count of unique email addresses it loaded.

Timeline

1. 5 May 2012

   The breach happened

2. 21 May 2016

   Added to Have I Been Pwned