LinkedIn Breach Exposes 164 M Email Addresses and Password Hashes
What Happened
In May 2016, data from a 2012 compromise of LinkedIn resurfaced on a dark‑web marketplace, revealing 164,611,595 user records. The exposed data consisted of email addresses and SHA‑1 password hashes that were stored without salting; most hashes were cracked shortly after disclosure.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of legacy password‑storage practices that undermine the integrity of authentication controls.
- Highlights the need for continuous credential‑risk monitoring and evidence of hash‑hardening as part of a control‑assurance program.
- Serves as a real‑world example of why documented remediation (e.g., migration to salted, adaptive‑hash algorithms) must be auditable and repeatable.
Who Is Affected
- Professional networking platforms
- Any SaaS provider that stores user credentials
- Organizations whose employees use LinkedIn for business networking
Recommended Actions
- Review all vendor contracts for password‑storage requirements and enforce modern hashing standards (e.g., Argon2, bcrypt, scrypt).
- Validate that continuous monitoring tools flag weak‑hash algorithms and trigger remediation workflows.
- Request a detailed incident‑response disclosure from the vendor and update your third‑party risk register.
Technical Notes
- Attack vector: Credential theft via compromised internal systems (original 2012 breach).
- CVE(s): None reported; the issue stems from insecure hashing practices rather than a software vulnerability.
- Data types exposed: Email addresses, SHA‑1 password hashes (unsalted).
Source: https://haveibeenpwned.com/api/v3/breach/LinkedIn