2012 LinkedIn hack
LinkedIn leaked out approximately 6.5 million passwords as of June 8, 2012.
|
|
| Location | Globally |
|---|---|
| Cause | Hack |
| Website | www |
The social networking website LinkedIn was hacked on 5 June 2012, and passwords for nearly 6.5 million user accounts were stolen by Russian cybercriminals. Owners of the hacked accounts were no longer able to access their accounts, and the website repeatedly encouraged its users to change their passwords after the incident. Vicente Silveira, the director of LinkedIn, confirmed, on behalf of the company, that the website was hacked in its official blog. He also said that the holders of the compromised accounts would find their passwords were no longer valid on the website.
The stolen passwords, which were hashed (i.e. just a checksum was stored, allowing testing whether a given password is the correct one), were cracked and posted on a Russian password forum later on that day. By the morning of June 6, passwords for thousands of accounts were available online in plain text. Graham Cluley of the internet security firm Sophos warned that the leaked passwords could be in the possession of criminals by 6 June. LinkedIn said, in an official statement, that they would email all its members with security instructions and instructions on how they could reset their passwords.
In May 2016, LinkedIn discovered an additional 100 million email addresses and hashed passwords that claimed to be additional data from the same 2012 breach. In response, LinkedIn invalidated the passwords of all users that had not changed their passwords since 2012.
Rep. Mary Bono Mack of the United States Congress commented on the incident, "How many times is this going to happen before Congress finally wakes up and takes action? This latest incident once again brings into sharp focus the need to pass data protection legislation." Senator Patrick Leahy said, "Reports of another major data breach should give pause to American consumers who, now more than ever, share sensitive personal information in their online transactions and networking ... Congress should make comprehensive data privacy and cybercrime legislation a top priority." Marcus Carey, a security researcher for Rapid7, said that the hackers had penetrated the databases of LinkedIn in the preceding days. He expressed concerns that they may have had access to the website even after the attack. Michael Aronowitz, Vice President of Saveology said, "Everyday hundreds of sites are hacked and personal information is obtained. Stealing login information from one account can easily be used to access other accounts, which can hold personal and financial information." Security experts indicated that the stolen passwords were encrypted in a way that was fairly easy to decrypt, which was one of the reasons for the data breach. Katie Szpyrka, a long time user of LinkedIn from Illinois, United States, filed a $5 million lawsuit against LinkedIn, complaining that the company did not keep their promises to secure connections and databases. Erin O’Harra, a spokeswoman working for LinkedIn, when asked about the lawsuit, said that lawyers were looking to take advantage of that situation to again propose the bills SOPA and PIPA in the United States Congress. An amended complaint was filed on Nov. 26, 2012 on behalf of Szpyrka and another premium LinkedIn user from Virginia, United States, named Khalilah Gilmore–Wright, as class representatives for all LinkedIn users who were affected by the breach. The lawsuit sought injunctive and other equitable relief, as well as restitution and damages for the plaintiffs and members of the class.
...
Wikipedia