LinkedIn Breached Data For Sale Dirt Cheap

If we’ve said it once, we’ve said a million times: Use a unique password for every single online account. This now especially applies if you are or ever have been on LinkedIn and haven’t changed your password in a while. Data for over 167 million LinkedIn users has been found up for sale on the dark web. So stop what you’re doing and go change your LinkedIn login password. When doing so, make sure you follow the strong password guidelines:

• It should be different from any other online account;
• It should contain at least eight characters;
• It should have at least one number and more is better;
• It should contain at least one special character;
• It should not be a word found in a dictionary or include any sensitive information about you or someone close to you such as your driver’s license number or birthdate;
• It should have a combination of upper and lower case letters.

This is a situation in which reusing passwords may especially risky, as it is believed the hackers acquired this information from a breach that occurred in 2012.  The data retrieved included user IDs, email addresses, and passwords that use the outdated SHA1 password hashes. This means that those passwords are easier to crack than if they were encrypted with more secure methods.

LinkedIn required all users to change their password after the breach was discovered, so LinkedIn accounts are not the being targeted with this information. The accounts at risk are those that can be accessed with the same user name/password information obtained in LinkedIn breach. Every online account should have a unique password to protect against brute force attacks (a program that uses breached credentials to rapidly attempt gain access to other sites using breached credentials). 

Of the 167 million records, 50 million are thought to have used Facebook or another type of login process, which may indicate they are tougher to crack. However, some analysts say the security behind that is not particularly secure either, so even if you use one of those ways to login to LinkedIn, you should play it safer and change passwords for that account too and for any account for which you used the same credentials as LinkedIn.

LinkedIn also offers a two-step login process under the Privacy Settings. Whenever that is offered on an online account, consider taking advantage of it. This will require you to confirm something else before granting access.

In cases where an email address is stolen, spear-phishers may try to lure you into providing more information by sending tailored email messages to you. Don't click on any links or attachments in email messages to avoid giving up more sensitive data or executing malware onto your device.

Adding insult to injury in this situation is that the price tag is a measly five Bitcoin or about $2,200 at current rates. Whoever buys it will get it at a bargain basement price! So don’t give them bonus data from other accounts by reusing passwords.