Platform denies breach, says key info may have been ‘scraped’ from site
Close on the heels of a data hack at Facebook and MobiKwik, LinkedIn faced a massive breach wherein details of over 500 million users have been scraped from the platform and posted online for sale on a popular hacker forum.
The dataset includes sensitive information such as email addresses, phone numbers, workplace details, full names, gender, account IDs, and links to users’ other social media accounts.
According to Cybernews, which broke the story, an unidentified threat actor is purporting to have scraped information from 500 million LinkedIn accounts, which is no less than two-thirds of the site’s entire user base. The leaked information, which is up for grabs in an auction with a minimum four-digit asking price, allegedly includes a wide range of data.
Also Read: Try Not To Fall Prey To Charge/Visa Cloning, Skimming Tricks, Follow These Progression
To boost the veracity of their claims, the hacker posted a sample of some two million records that includes users’ LinkedIn IDs, full names, email addresses, phone numbers, gender, workplace information, and links to their social media profiles among others. Interested parties can view the leaked samples for as little as US$2.
The Microsoft-owned social network, however, disputes that all of the information came solely from them. “This was not a LinkedIn data breach, and no private member account data from LinkedIn was included in what we’ve been able to review,” reads the statement by LinkedIn.
“We have investigated an alleged set of LinkedIn data that has been posted for sale and have determined that it is actually an aggregation of data from a number of websites and companies,” said LinkedIn. However, the site did go on to confirm that the database includes information from publicly viewable member profiles, which may have been scraped from its website.
It remains unclear whether the data that is being offered for sale is up-to-date or was collected from a previous data breach suffered by the professional social network and other companies.
And, as ESET Chief Security Evangelist Tony Anscombe astutely noted, most information obtained from data breaches doesn’t really diminish in value over time, which means sufficiently motivated threat actors could abuse it for all manner of attacks. This includes targeted phishing campaigns and social engineering attacks or the leaked data could even be used to perpetrate identity fraud.
To mitigate the chances of falling victim to enterprising cybercriminals, LinkedIn users would do well to double down on their security. Most of all, be wary of unsolicited messages from strangers that contain suspicious links or attachments. If you suspect that your data might be part of the leak, consider changing your password, or better yet use a password manager that will generate a hard-to-crack password for you. Enabling multi-factor authentication, ideally using a hardware token or a mobile app, is also strongly recommended.
