2012 LinkedIn hack

Short description: Data breach of LinkedIn

The 2012 LinkedIn hack refers to the computer hacking of LinkedIn on June 5, 2012. Passwords for nearly 6.5 million user accounts were stolen. Yevgeniy Nikulin was convicted of the crime and sentenced to 88 months in prison.

Owners of the hacked accounts were unable to access their accounts. LinkedIn said, in an official statement, that they would email members with instructions on how they could reset their passwords. In May 2016, LinkedIn discovered an additional 100 million email addresses and passwords that had been compromised from the same 2012 breach.

## Contents

* 1 History
* 1.1 The hack
* 1.2 Leak
* 1.3 Reaction
* 1.4 Response from LinkedIn
* 2 Arrest and conviction of suspect
* 3 References

## History

### The hack

The social networking website LinkedIn was hacked on June 5, 2012, and passwords for nearly 6.5 million user accounts were stolen by Russian cybercriminals.[1][2] Owners of the hacked accounts were no longer able to access their accounts, and the website repeatedly encouraged its users to change their passwords after the incident.[3] Vicente Silveira, the director of LinkedIn,[4] confirmed, on behalf of the company, that the website was hacked in its official blog. He also said that the holders of the compromised accounts would find their passwords were no longer valid on the website.[5]

In May 2016, LinkedIn discovered an additional 100 million email addresses and hashed passwords that claimed to be additional data from the same 2012 breach. In response, LinkedIn invalidated the passwords of all users that had not changed their passwords since 2012.[6]

### Leak

A collection containing data about more than 700 million users, believed to have been scraped from LinkedIn, was leaked online in September, 2021 in form of a torrent file after hackers previously tried to sell it earlier in June, 2021.[7]

### Reaction

Internet security experts said that the passwords were easy to unscramble because of LinkedIn's failure to use a salt when hashing them, which is considered an insecure practice because it allows attackers to quickly reverse the scrambling process using existing standard rainbow tables, pre-made lists of matching scrambled and unscrambled passwords.[8] Another issue that sparked controversy was the iOS app provided by LinkedIn, which grabs personal names, emails, and notes from a mobile calendar without the user's approval.[9] Security experts working for Skycure Security said that the application collects a user's personal data and sends it to the LinkedIn server. LinkedIn claimed the permission for this feature is user-granted, and the information is sent securely using the Secure Sockets Layer (SSL) protocol. The company added that it had never stored or shared that information with a third party.[10][11]

Rep. Mary Bono Mack of the United States Congress commented on the incident, "How many times is this going to happen before Congress finally wakes up and takes action? This latest incident once again brings into sharp focus the need to pass data protection legislation." Senator Patrick Leahy said, "Reports of another major data breach should give pause to American consumers who, now more than ever, share sensitive personal information in their online transactions and networking ... Congress should make comprehensive data privacy and cybercrime legislation a top priority."[12][13]

Marcus Carey, a security researcher for Rapid7, said that the hackers had penetrated the databases of LinkedIn in the preceding days.[14] He expressed concerns that they may have had access to the website even after the attack.

Michael Aronowitz, Vice President of Saveology said, "Everyday hundreds of sites are hacked and personal information is obtained. Stealing login information from one account can easily be used to access other accounts, which can hold personal and financial information." Security experts indicated that the stolen passwords were encrypted in a way that was fairly easy to decrypt, which was one of the reasons for the data breach.[15]

Katie Szpyrka, a long time user of LinkedIn from Illinois, United States, filed a $5 million lawsuit against LinkedIn, complaining that the company did not keep their promises to secure connections and databases. Erin O’Harra, a spokeswoman working for LinkedIn, when asked about the lawsuit, said that lawyers were looking to take advantage of that situation to again propose the bills SOPA and PIPA in the United States Congress.[16]

An amended complaint was filed on Nov. 26, 2012 on behalf of Szpyrka and another premium LinkedIn user from Virginia, United States, named Khalilah Gilmore–Wright, as class representatives for all LinkedIn users who were affected by the breach.[17] The lawsuit sought injunctive and other equitable relief, as well as restitution and damages for the plaintiffs and members of the class.[17]

### Response from LinkedIn

LinkedIn apologized immediately after the data breach and asked its users to immediately change their passwords.[1] The Federal Bureau of Investigation assisted the LinkedIn Corporation in investigating the theft. As of 8 June 2012, the investigation was still in its early stages, and the company said it was unable to determine whether the hackers were also able to steal the email addresses associated with the compromised user accounts as well.[18] LinkedIn said that the users whose passwords are compromised would be unable to access their LinkedIn accounts using their old passwords.[19]

## Arrest and conviction of suspect

On October 5, 2016, Russian hacker Yevgeniy Nikulin was detained by Czech police in Prague. The United States had requested an Interpol warrant for him.[20]

A United States grand jury indicted Nikulin and three unnamed co-conspirators on charges of aggravated identity theft and computer intrusion. Prosecutors alleged that Nikulin stole a LinkedIn employee's username and password, using them to gain access to the corporation's network. Nikulin was also accused of hacking into Dropbox and Formspring, allegedly conspiring to sell stolen Formspring customer data, including usernames, e-mail addresses, and passwords.[21]

Nikulin was convicted and sentenced to 88 months of imprisonment.[22]

## References

1. ↑ 1.0 1.1 "An update on the hack". Linkedin. http://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised/.
2. ↑ "Hackers steal 6.5 million passwords from LinkedIn". Herald Sun. http://www.heraldsun.com.au/news/more-news/hackers-steal-65-million-linkedin-passwords/story-fn7x8me2-1226388063745.
3. ↑ "LinkedIn Confirms, Apologizes for Stolen Password Breach". Mashable.com. June 6, 2012. http://mashable.com/2012/06/06/linkedin-passwords-hacked-confirmation/.
4. ↑ "LinkedIn busy to investigate". The Economic Times. June 10, 2012. http://economictimes.indiatimes.com/tech/internet/linkedin-working-with-fbi-on-password-leak-of-its-members/articleshow/13999053.cms.
5. ↑ "Update:Linked in confirms it is hacked". Pc world.com. June 6, 2012. http://www.pcworld.com/article/257045/update_linkedin_confirms_account_passwords_hacked.html.
6. ↑ "Protecting Our Members". LinkedIn. https://blog.linkedin.com/2016/05/18/protecting-our-members.
7. ↑ "Hackers leak LinkedIn 700 million data scrape". TheRecord.media. September 22, 2021. https://therecord.media/hackers-leak-linkedin-700-million-data-scrape/.
8. ↑ "LinkedIn suffers data breach-security experts". Reuters. June 6, 2012. http://in.reuters.com/article/2012/06/06/linkedin-breach-idINDEE8550EN20120606.
9. ↑ Kingsley-Hughes, Adrian. "LinkedIn ios app grabs names, emails, notes- from your calendar.". Forbes.com. https://www.forbes.com/sites/adriankingsleyhughes/2012/06/06/linkedin-ios-app-grabs-names-emails-and-notes-from-your-calendar/.
10. ↑ "LinkedIn iOS app privacy issues concern people". Mashable.com. June 6, 2012. http://mashable.com/2012/06/06/linkedin-ios-app-privacy-issues-and-two-other-stories-you-need-to-know/.
11. ↑ Gune, Aditya (2017). "The Cryptographic Implications of the LinkedIn Data Breach". arXiv:1703.06586 [cs.CR].
12. ↑ "LinkedIn Passwords Leaked... Congress Immediately Wants To 'Do Something!'". Techdirt.com. June 7, 2012. http://www.techdirt.com/articles/20120606/17382119230/linkedin-passwords-leaked-congress-immediately-wants-to-do-something.shtml.
13. ↑ Sasso, Brendan (6 June 2012). "Lawmakers concerned by report that LinkedIn passwords were stolen". Hillicon Valley. https://thehill.com/policy/technology/116310-lawmakers-concerned-by-report-that-linkedin-passwords-were-stolen/.
14. ↑ "Hacker claims to have stolen millions of passwords". The Mercury News. http://www.mercurynews.com/business/ci_20795060/hacker-claims-have-stolen-millions-linkedin-passwords.
15. ↑ "Over 6 million encrypted LinkedIn passwords leaked online" (Press release). Margate, FL: PRWeb. Archived from the original on November 16, 2015. Retrieved April 18, 2013.
16. ↑ "LinkedIn sued for $5 million over hacked passwords". The News Tribe.com. June 21, 2012. http://www.thenewstribe.com/2012/06/21/linkedin-sued-for-5-million-over-hacked-passwords/.
17. ↑ 17.0 17.1 Constantin, Lucian (March 6, 2013). "LinkedIn wins dismissal of lawsuit seeking damages for massive password breach". PC World. http://www.pcworld.com/article/2030129/linkedin-wins-dismissal-of-lawsuit-seeking-damages-for-massive-password-breach.html/.
18. ↑ "FBI to help LinkedIn". Gadgets.NDTV.com. June 8, 2012. http://gadgets.ndtv.com/social-networking/news/fbi-to-help-linkedin-on-password-theft-228800.
19. ↑ "LinkedIn gets hacked". Fox10TV.com. http://www.fox10tv.com/dpp/only_on_fox10/daily_dot_com/linkedin-gets-hacked.
20. ↑ Treshchanin, Dmitry; Shchetko, Nick (October 20, 2016). "Exclusive: Digital Trail Betrays Identity Of Russian 'Hacker' Detained In Prague". RadioFreeEurope/RadioLiberty. http://www.rferl.org/a/russia-hacker-prague-identity-nikulin/28065492.html.
21. ↑ "U.S. Charges Russian Hacker With Stealing LinkedIn Data". RadioFreeEurope/RadioLiberty. October 22, 2016. http://www.rferl.org/a/us-charges-russian-hacker-nikulin-stealing-date-linkedin-san-francisco-dropbox-formspring-/28068596.html.
22. ↑ Stone, Jeff (September 29, 2020). "LinkedIn hacker Nikulin sentenced to 7 years in prison after years of legal battles". https://www.cyberscoop.com/nikulin-sentence-russian-cybercrime-linkedin-hacker/.

* v
* t
* e

LinkedIn

A subsidiary of Microsoft

Subsidiaries|

* Bright.com
* Connectifier
* LinkedIn Learning
* LinkedIn Pulse
* LinkedIn SlideShare

People|

* Reid Hoffman
* Rashmi Sinha
* Lynda Weinman

Facilities|

* 222 Second Street

Events|

* 2012 LinkedIn hack

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/2012 LinkedIn hack. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=2012_LinkedIn_hack&oldid=4228919"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template