MySpace data breach: what happened and what to do

MySpace was the biggest social network in the world in the mid-2000s. Have I Been Pwned (HIBP) lists a MySpace breach dated July 2008 and added it to its database on May 31, 2016.

What happened

In May 2016 a seller offered a database of MySpace accounts for sale. Time Inc., which owned MySpace then, confirmed that someone was selling the passwords, reported at 427 million, and the company said accounts created before June 11, 2013 were affected. That's the date it upgraded its password security.

The breach itself happened years earlier. HIBP's date of July 2008 is approximate, and security researcher Troy Hunt has said he believes it was more likely late 2008 or early 2009. HIBP's copy holds 359,420,698 accounts, and that is the figure used here. Other outlets quote numbers around 360 million.

What was exposed

HIBP lists these data types:

• Email addresses
• Usernames
• Passwords

The passwords were stored as unsalted SHA-1 hashes. A hash is a scrambled version of a password, and "unsalted" means identical passwords produce identical hashes, which lets attackers crack huge numbers at once. SHA-1 is also a fast, old method. Hashes like that are quick to crack.

Why an old breach still matters

Most people stopped using MySpace long ago, but their passwords didn't stop existing. Many people reused the same email and password on Gmail, Facebook and banks for years. When a breach like this is cracked and traded, those pairs are tried against other sites. That's called credential stuffing, and it works because reuse is common.

If you had a MySpace account in the 2000s, assume the password you used then has been cracked. If any account of yours still uses that password, or a close variation, it's exposed.

What criminals can do with it

An email address and an old password is often enough to try to get into a current account. The email address also feeds phishing and spam lists. Usernames from 2008 can reveal a long-lived online identity that people still use elsewhere.

MySpace's response

Time Inc. confirmed in late May 2016 that someone was trying to sell the passwords. The sources used here don't describe a settlement.

Serus can't remove breach data that's already been copied around. What it does is monitor breach databases and the dark web for your email and other details, and alert you when they show up. The steps below are the ones that matter for a breach this old.

How to check your own exposure

Search your email address on Have I Been Pwned, which is free and doesn't ask for a password. Try any older or secondary addresses too, since people forget the ones they used years ago.