You've Been Scraped data breach: what happened and what to do
In late 2018 researcher Bob Diachenko found exposed databases holding over 66 million records believed scraped from LinkedIn. They had names, email addresses, job titles, employers and profile links. The owner was never identified.
View all 13,115 breaches- Breach date
- 5 Oct 2018
- Affected
- 66,147,869
- Data exposed
- Email addresses, Employers, Geographic locations, Job titles, Names, Social media profiles
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In October and November 2018, security researcher Bob Diachenko found several unprotected MongoDB databases believed to belong to a data aggregator. Together they held over 66 million records. Have I Been Pwned (HIBP) named the incident "You've Been Scraped" and added it on December 6, 2018.
What happened
Nobody has identified who ran the databases, so there's no company notice or apology. HIBP says the data is believed to have been scraped from LinkedIn, which explains the name. Scraping means automated collection of information that people had put on public profiles. The databases were open to anyone who found them.
What was exposed
HIBP counts 66,147,869 accounts. The data classes are email addresses, employers, geographic locations, job titles, names and social media profiles. The records included both work and personal email addresses, plus links to LinkedIn profiles.
No passwords were included.
What that lets criminals do
Scraped data is useful for targeted phishing. A scammer who knows your name, employer, job title and city can write a message that looks like a recruiter, a vendor or a colleague. The personal email addresses matter most, because they connect your work identity to your private inbox, where there is often less filtering.
What to do now
You can't take the records back, and there's no company to ask. Instead, limit what a stranger can do with them. Treat unexpected job offers and messages that cite your employer with care, and check who's behind a profile before you answer. Review what your public profile shows and trim anything you wouldn't hand to a stranger.
What to do if you were in it
- 1
Be wary of recruiter and vendor messages
A message that gets your job title and employer right isn't proof it's real. Look up the sender on the company's own site and reply there.
- 2
Review your public profile
Remove personal email addresses, phone numbers and anything else you don't want public. Less public detail means less to scrape.
- 3
Don't click links in breach-themed messages
Go to the company's site yourself. Fake breach alerts are common.
- 4
See which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone.
Frequently asked
Was I affected by the You've Been Scraped breach?
If you had a public LinkedIn profile in 2018, you may be in it. Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 66,147,869 accounts.
Who was behind it?
Nobody knows. The owner of the databases was never identified, and HIBP says the data is believed to have been scraped from LinkedIn.
Were passwords exposed?
No. HIBP lists email addresses, employers, locations, job titles, names and social media profiles.
Should I change my password?
Not because of this breach. Do turn on two-factor login on your email and work accounts, since scammers may try to target you.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
