LinkedIn hacked again, 700 million users’ data sold on the dark web

LinkedIn records another serious breach of its users' data after the one we discussed last April. The data of almost all its users ended up online and put up for sale on the Dark Web.

We are talking about 700 million accounts involved, that is to say over 90% of the 756 million users registered on LinkedIn. A user (“GOD User” TomLiner) released an excerpt with the data of 1 million LinkedIn users to prove the veracity of the material he decided to put up for sale using the hacker forum channel.

From the first results it seems to be records with sensitive information, namely:

Email Addresses
Full names
Phone numbers
Physical addresses
Geolocation records
LinkedIn username and profile URL
Personal and professional experience/background
Genders
Other social media accounts and usernames

Restoreprivacy has examined the sample of data in detail and points out that the information appears authentic, traceable to really existing users, and updated - there are records with data from 2020 and 2021. It does not appear that the stolen information also includes financial data and credentials of access to the LinkedIn account, but for now the extent of the breach is not actually known.

It is speculated that the hackers were able to download the valuable information using a LinkedIn API; there would therefore have been no real violation (unauthorized access) to the servers. This version, however, is not confirmed by the platform managers who have yet to intervene on the case. If the numbers are confirmed, it is easy to predict that among the victims there are also many Italian users. On the occasion of the previous violation, the Privacy Guarantor had intervened by opening an investigation. Clarifications are now awaited from the company's top management.

The company's top executives said:"While we’re still investigating this issue, our initial analysis indicates that the dataset includes information scraped from LinkedIn as well as information obtained from other sources. This was not a LinkedIn data breach and our investigation has determined that no private LinkedIn member data was exposed. Scraping data from LinkedIn is a violation of our Terms of Service and we are constantly working to ensure our members’ privacy is protected."

What this leak means for LinkedIn users

The leaked information poses a threat to affected LinkedIn users. With details such as email addresses and phone numbers made available to buyers online, individuals could become the target of spam campaigns, or worse still, victims of identity theft.

Even though the records don’t appear to contain any information such as credit card details or private messages, expert hackers may still be able to track down sensitive data through just an email address. LinkedIn users could also be on the receiving end of email or telephone scams that trick them into sharing sensitive credentials or transferring large amounts of money.

Brute force attacks are also something that LinkedIn users affected by the leak will need to be aware of. Using email addresses provided in the records, hackers may attempt to access users’ accounts using various combinations of common password characters.

Finally, targeted advertising towards specific users becomes much more probable thanks to this list. With information about users’ jobs and gender, companies can more easily market their products to individuals.

What to do if you are part of the leak

Although password and email address combinations are not a part of this recent leak, it is a good idea to secure your LinkedIn account by updating your password and passwords for your other online accounts. Enabling two-factor authentication will also help prevent brute force attacks, which are a likely result of this recent data leak.

What users risk from unauthorized disclosure of their data are the usual dangers that can be encountered in similar circumstances: identity theft, phishing attempts and account breach. While waiting for an update on the case, changing your account login password is always a good suggestion and costs nothing.

References:
LinkedIn statement: https://news.linkedin.com/2021/april/an-update-from-linkedin