LiveJournal livejournal.com LiveJournal data breach: what happened and what to do
A database of 26 million LiveJournal accounts, with usernames, email addresses and plain text passwords, was shared in 2020. It dates back to about 2017. LiveJournal's owner has not confirmed a breach.
View all 13,115 breaches- Breach date
- Jan 2017
- Affected
- 26,372,781
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In mid-2019, news broke of an alleged LiveJournal data breach. In May 2020 an archive of the data was shared on a hacking forum and then spread widely. Have I Been Pwned (HIBP) counts 26,372,781 accounts. The breach is dated to 2017, though that may only be the date the data was last verified.
What was exposed
The records contain usernames, email addresses and passwords stored in plain text. That last point is what makes this one serious: nobody has to crack anything, the password is simply there. HIBP confirmed that both the usernames and emails exist on LiveJournal.
Links to Dreamwidth
Dreamwidth, a fork of LiveJournal with an overlapping user base, reported credential stuffing attacks from 2018. Credential stuffing means trying leaked email and password pairs on other sites. Dreamwidth told users to treat any password they ever used on LiveJournal as compromised.
What the company said
LiveJournal's owner has not confirmed a breach, and says the database and the attacks on Dreamwidth are unrelated.
What it lets criminals do
Old plain text passwords are used in credential stuffing and in sextortion emails that quote a real password to prove the sender has your data. If you get one, the password is old, not current.
What to do
Change any password you ever used on LiveJournal, and everywhere it was reused.
What to do if you were in it
- 1
Change your LiveJournal password
Go to the account settings and pick a new password. If the site is gone or you no longer use it, you can skip this step. The password was exposed in plain text, so change it even if you rarely log in.
- 2
Change it everywhere you reused it
Look through your password manager or browser for logins that share the old password and replace each one, starting with email, banking and shopping accounts. Use a different password for every site.
- 3
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email and any account that holds money or personal details. A stolen password alone then isn't enough to get in.
- 4
Expect phishing that uses your email address
Treat unexpected messages about your account, a prize or a password reset with suspicion. Don't click links in them: type the site address yourself or use its app.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the LiveJournal breach?
If you had a LiveJournal account up to about 2017, possibly. Search your email on HIBP.
What was exposed in the LiveJournal breach?
Usernames, email addresses and plain text passwords for about 26 million accounts.
Did LiveJournal confirm the breach?
No. Its owner has not confirmed a breach, though HIBP confirmed that the usernames and emails in the data exist on the site.
I got an email quoting my old password. What now?
That is a common sextortion scam built from leaked data. Don't pay or reply, and change the password anywhere you still use it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
