LinkedIn Data Breach

What happened

In June 2012, approximately 6.5 million password hashes belonging to LinkedIn users were posted to a Russian hacker forum. The passwords had been hashed using the SHA-1 algorithm without cryptographic salt, making them highly vulnerable to dictionary attacks and rainbow tables. In 2016, a hacker known as 'Peace' offered the data of 167 million users, including 117 million passwords, for sale on the dark web, revealing the breach was much larger than initially disclosed.

Technical mechanism

Attackers gained access to LinkedIn's database and extracted user credentials. The passwords were encrypted using unsalted SHA-1 hashes, which allowed attackers to rapidly crack a large percentage of the passwords using precomputed hash tables.

Why it matters

The LinkedIn breach was a landmark event that highlighted the dangers of using unsalted cryptographic hashes for password storage, leading to widespread industry adoption of stronger password hashing and salting practices.

Impact

Millions of user passwords were exposed and cracked. LinkedIn faced reputational damage, a class-action lawsuit resulting in a $1.25 million settlement, and was forced to mandate password resets and implement two-factor authentication.

Response

LinkedIn invalidated the passwords of affected accounts, required password resets, and updated its security practices to use salted hashes and offer two-step verification. The company also engaged law enforcement.

Defensive lessons

• Password hashes must be salted to protect against rainbow table attacks.
• Organizations should use strong, modern hashing algorithms (like bcrypt, scrypt, or Argon2) rather than outdated algorithms like SHA-1.
• Multi-factor authentication (MFA) is essential for protecting user accounts even if passwords are compromised.

Evidence register

1. LinkedIn — Notice of data breach: May 2016 (verified)
2. CBS News — LinkedIn: 2012 data breach much worse than we thought (verified)