LinkedIn linkedin.com LinkedIn scraped data 2021: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In 2021 attackers scraped data from public LinkedIn profiles and sold it online. Have I Been Pwned counts 125 million unique email addresses, with names, job titles, locations, genders and social profiles. LinkedIn says it was scraping, not a breach of private data.
View all 13,118 breaches- Breach date
- 8 Apr 2021
- Affected
- 125,698,496
- Data exposed
- Education levels, Email addresses, Genders, Geographic locations, Job titles, Names, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In the first half of 2021, attackers scraped data from public LinkedIn profiles and offered it for sale online. Have I Been Pwned describes about 400 million records containing 125 million unique email addresses, and added the data in October 2021.
LinkedIn's position, in its June 2021 update, is that this was not a data breach and no private member data was exposed. It said the data was gathered by scraping LinkedIn and other websites, and that scraping violates its terms of service.
Sources checked: haveibeenpwned.com, news.linkedin.com
Last verified against the official page:
What was exposed
Have I Been Pwned lists education levels, email addresses, genders, geographic locations, job titles, names and social media profiles. No passwords are listed.
What it means for you
Scraped data is mostly information people chose to show publicly, but combining it is what makes it useful to criminals. A name, employer, job title and email address is the raw material for targeted phishing, such as a fake message from a recruiter or a colleague. Because no passwords were involved, a password change is not urgent for this incident, but it costs nothing and a unique password is a good habit.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Scammers use leaked email addresses and job detailses to send convincing messages. Don't click links in unexpected emails or texts about your account, and go to the site directly instead.
- 2
Be careful with recruiter and job messages
Targeted scams often pose as recruiters or colleagues and quote your real job title. Check the sender's profile and company independently before opening attachments or sharing details.
- 3
Review what your profile shows publicly
In LinkedIn's settings you can limit who sees your email address, location and connections. It won't undo past scraping, but it limits what the next scraper gets.
- 4
Turn on two-factor login
Two-factor login on your LinkedIn account and your email makes phishing less likely to turn into a takeover.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus keeps monitoring breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was LinkedIn hacked in 2021?
LinkedIn says no. It describes the incident as scraping of public and other website data, not a breach of private member data.
Was I affected?
If your profile was public in 2021, your details may be in the scraped data. Check your email on Have I Been Pwned or run a free Serus scan.
Were passwords exposed?
No passwords are listed in the data. The exposed fields were emails, names, job titles, locations, genders, education levels and social profiles.
Sources
- Have I Been Pwned: LinkedInScrape
- Have I Been Pwned: LinkedIn Scraped Data (2021) Data Breach · haveibeenpwned.com
- An update from LinkedIn · news.linkedin.com
Something wrong or out of date? Tell us and we'll re-check it.
