Make sure to add us or contact us for the latest news
 |
 |
 |
 |
 |
 |
 |
Scraped data of 500 million LinkedIn users being sold online, 2 million records leaked as proof
Days after a massive Facebook data leak made the headlines, it seems like we’re in for another one, this time involving LinkedIn.
An archive containing data purportedly scraped from 500 million LinkedIn profiles has been put for sale on a popular hacker forum, with another 2 million records leaked as a proof-of-concept sample by the post author.
The four leaked files contain information about the LinkedIn users whose data has been allegedly scraped by the threat actor, including their full names, email addresses, phone numbers, workplace information, and more.
To see if your email address has been exposed in this data leak or other security breaches, use our personal data leak checker with a library of 15+ billion breached records.
While users on the hacker forum can view the leaked samples for about $2 worth of forum credits, the threat actor appears to be auctioning the much-larger 500 million user database for at least a 4-digit sum, presumably in bitcoin.
The author of the post claims that the data was scraped from LinkedIn. Our investigation team was able to confirm this by looking at the samples provided on the hacker forum. However, it’s unclear whether the threat actor is selling up-to-date LinkedIn profiles, or if the data has been taken or aggregated from a previous breach suffered by LinkedIn or other companies.
Updated on 09/04: A statement from LinkedIn appears to confirm the latter: the company states that the data for sale was not acquired as a result of a data breach, and “is actually an aggregation of data from a number of websites and companies.”
“This was not a LinkedIn data breach, and no private member account data from LinkedIn was included in what we’ve been able to review.”
LinkedIn facing a probe from Italy’s privacy watchdog
Following “the dissemination of user data, including IDs, full names, email addresses, telephone numbers” by the threat actor, Italy’s privacy watchdog began an investigation into the incident on Thursday.
The Italian authority said that the country has one of the highest LinkedIn subscriber counts among European states and called on affected users to “pay particular attention to any anomalies” related to their phone number and their account.
A new collection with 327M more LinkedIn profiles appears on hacker forum
Updated on 10/04: It seems that other threat actors are looking to piggyback on the leak. On Friday, a new collection of LinkedIn databases has been put for sale on the same hacker forum by another user – for $7,000 worth of bitcoin.
The new author claims to be in possession of both the original 500-million database, as well as six additional archives that allegedly include 327 million scraped LinkedIn profiles:
If true, this would put the overall number of scraped profiles at 827 million, exceeding LinkedIn’s actual user base of 740+ million by more than 10%. This means that some, if not most, of the new data sold by the threat actor might be either duplicate or outdated.
What was leaked?
Based on the samples we saw from the leaked files, they appear to contain a variety of mostly professional information from LinkedIn profiles, including:
- LinkedIn IDs
- Full names
- Email addresses
- Phone numbers
- Genders
- Links to LinkedIn profiles
- Links to other social media profiles
- Professional titles and other work-related data
An example of leaked data:
What’s the impact of the leak?
The data from the leaked files can be used by threat actors against LinkedIn users in multiple ways by:
- Carrying out targeted phishing attacks.
- Spamming 500 million emails and phone numbers.
- Brute-forcing the passwords of LinkedIn profiles and email addresses.
The leaked files appear to only contain LinkedIn profile information – we did not find any deeply sensitive data like credit card details or legal documents in the sample posted by the threat actor. With that said, even an email address can be enough for a competent cybercriminal to cause real damage.
Particularly determined attackers can combine information found in the leaked files with other data breaches in order to create detailed profiles of their potential victims. With such information in hand, they can stage much more convincing phishing and social engineering attacks or even commit identity theft against the people whose information has been exposed on the hacker forum.
Next steps
If you suspect that your LinkedIn profile data might have been scraped by threat actors, we recommend you:
- Use our the cybernews personal data leak checker to find out if your LinkedIn data has been leaked by the threat actor.
- Beware of suspicious LinkedIn messages and connection requests from strangers.
- Change the password of your LinkedIn and email accounts.
- Consider using a password manager to create strong passwords and store them securely.
- Enable two-factor authentication (2FA) on all your online accounts.
Also, watch out for potential phishing emails and text messages. Again, don’t click on anything suspicious or respond to anyone you don’t know.
We’re here to help you navigate the Dark Web and whether you have been exposed. Reach out today for us to help you discover if you are on the Dark Web.
Dark Web ID’s Top Threats This Week
United States – CareFirst BlueCross BlueShield Community Health Plan District of Columbia (CHPDC)
Exploit: Nation-State Hacking
CareFirst BlueCross BlueShield Community Health Plan District of Columbia (CHPDC): Insurer
Risk to Business: 1.761= Severe
CareFirst BlueCross BlueShield’s Community Health Plan District of Columbia (CHPDC) has announced a data breach carried out by what it described as a “foreign cybercriminal” group. The insurer confirmed that sensitive information about members was snatched and that they’ve notified authorities including the FBI and the Office of the Attorney General for the District of Columbia
Individual Risk : 1.603 = Severe
In a written notification to customers, CHPDC noted that the stolen information may have included names, addresses, phone numbers, dates of birth, Medicaid identification numbers, and other medical information. The company is offering free two-year credit and identity theft monitoring and a website with more information on help for consumers.
Customers Impacted: Unknown
How It Could Affect Your Business: Nation-state cyberattack risks aren’t just a problem for government and military targets anymore. These clever cybercriminals will exploit any opening fast.
IntegraMSP to the Rescue: Make sure that everyone on the IT team is up to date on today’s threats and ready for tomorrow’s
United States – Office Depot
https://www.websiteplanet.com/blog/office-depot-leak-report/
Exploit: Unsecured Database
Office Depot: Business Supply Retailer
Risk to Business: 1.803 = Severe
Security researchers discovered a non-password-protected Elasticsearch database belonging to Office Depot that contained just under a million records. The exposed records were labeled as “Production” and contained customer information, file logs and other internal records for European customers, primarily in Germany. The company has addressed the issue.
Individual Risk: 2.267 = Severe
The exposed data includes names, phone numbers, physical addresses (home and/or office), @members.ebay addresses, and hashed passwords. The leak also exposed Marketplace logs and order history, exposing the customers’ past purchases and costs from European customer records.
Customers Impacted: 533 million
How it Could Affect Your Business Cybercriminals will benefit from this trove. Data like this is transacted every day on the dark web, providing ample ammunition for future cyberattacks and fraud.
IntegraMSP to the Rescue: Dark Web ID alerts businesses to credential compromise fast, giving them the edge to fix vulnerabilities before the bad guys even know they’re there. CONTACT US>>
United States – LinkedIn
Exploit: Hacking
LinkedIn: Social Media Network
Risk to Business: 1.612 = Severe
Bad actors have dropped notice that they’ve obtained an archive containing data purportedly scraped from 500 million LinkedIn profiles. A sample of data was posted on a popular hacker forum, with another 2 million records leaked as proof of the haul. More than 780,000 email addresses are associated with this leak. The initial listing contained 4 archives, but after LinkedIn denied the data breach, threat actors updated their ad to include 6 additional archives that allegedly include 327 million scraped LinkedIn profiles, putting the overall number of scraped profiles at 827 million including potential duplicates.
Individual Risk: 2.309 = Severe
This mass of leaked files contains PII about LinkedIn users including LinkedIn IDs, full names, email addresses, phone numbers, genders, links to LinkedIn profiles, links to other social media profiles, professional titles and other work-related data.
Customers Impacted: Unknown
How it Could Affect Your Business: Following hard on the heels of last week’s Facebook breach social media risks are multiplying fast and growing serious for businesses.
IntegraMSP to the Rescue: Dark web danger is growing for businesses as millions of records scraped from social media dues land in dark web markets create new vulnerabilities. PROTECT YOUR BUSINESS>>
United States – Personal Touch Holding Corp. (PTHC)
Exploit: Hacking
Personal Touch Holding Corp. (PTHC): Home Healthcare Provider
Risk to Business: 1.241 = Extreme
New York based medical services provider PTHC has announced a data breach impacting patients. The conglomerate operates Medicare-certified home health agencies, licensed home care service agencies, hospice at home services and Early Intervention Programs, as well as a managed care plan in New York. Both patient data and Member information has been impacted. The incident is under investigation.
Individual Risk: 1.412 = Extreme
Exposed patient information may include medical treatment information, insurance card and health plan benefit numbers, medical record numbers, first and last name, address, telephone numbers, date of birth, Social Security number, and financial information, including check copies, credit card numbers, and bank account information. Leaked Member information may include Medicaid ID number, ID number, provider name, clinical/medical information, first and last name, address, telephone number, date of birth, Social Security numbers, and credit card numbers and/or banking information if members paid their Medicaid surplus through credit card or check.
Customers Impacted: Unknown
How it Could Affect Your Business: This breach isn’t just going to cost a fortune to fix now – it’s also likely to incur a hefty regulatory penalty from state and federal authorities.
IntegraMSP Agent to the Rescue: Make sure that you’re covering all of the bases to avoid breaches and nasty regulatory action
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.