LinkedIn data breach: what happened and what to do

LinkedIn's best-known breach has two dates. The hack happened in 2012. The data surfaced four years later, in May 2016, when a seller offered it online. Both dates matter if you had an account back then.

What happened

In 2012, LinkedIn said some members' passwords had been stolen, forced a password reset on accounts it believed were affected, and told everyone to change their passwords. At the time it put the number of passwords involved at about 6.5 million.

In May 2016 a seller going by the name "Peace" offered a much larger set of email and password combinations for about 5 bitcoin. LinkedIn said it had learned of a further data set from the 2012 theft, invalidated the passwords of affected accounts and contacted those members to reset them. It said it had no indication of a new breach. Have I Been Pwned (HIBP) loaded the data and counts 164,611,595 email addresses.

What was exposed

HIBP lists two things: email addresses and passwords. The passwords were stored as SHA1 hashes without salt. That is a weak setup, because identical passwords produce identical hashes and attackers can crack common ones in bulk. HIBP notes the vast majority were cracked within days of the data being released.

What it lets criminals do

The risk here is credential stuffing: trying a leaked email and password pair on other sites. Because LinkedIn used the same address as the login for many people, and plenty of people reuse passwords, a 2012 password could unlock a different account years later. A cracked password also makes targeted phishing easier, since the attacker can quote something you really used.

An email address alone is mostly a spam and phishing risk. LinkedIn is also a work account, so scam messages that look like recruiter or connection requests are common follow-ups.

The company's response

LinkedIn invalidated the passwords it found in the 2016 set and emailed affected members to reset them.

If you had an account in 2012

You almost certainly changed your password since then. The question is whether you used the same one anywhere else. If you did, and you haven't changed it, fix that now.

Why a 2012 breach still matters

Old password data doesn't expire. Criminals keep large lists of leaked email and password pairs and try them against new targets, so a password you set in 2012 can still be tested on a bank, shop or email account today. The cracked LinkedIn set is one of the most widely circulated of those lists.

Two habits close most of the gap. First, a different password for every site, so one leak can't open the next account. Second, two-factor login on email, since email resets every other account. A password manager makes the first one painless.

Reading the numbers

The figures you'll see vary: 6.5 million, 117 million, 164 million. They refer to different things. The 6.5 million was what LinkedIn confirmed in 2012. The larger figures describe the data that appeared in 2016. HIBP's 164,611,595 counts the unique email addresses it loaded.