The LinkedIn leak that came back four years later

The story

On June 5, 2012, attackers broke into LinkedIn and stole scrambled versions of nearly 6.5 million passwords. LinkedIn reset those accounts and asked members to change their passwords.

The passwords had been scrambled in a way that is quick to undo. LinkedIn had skipped a standard step called salting, which makes each scrambled password unique. Without it, attackers could use ready-made lookup tables to turn most of them back into readable passwords.

In May 2016, it emerged that the 2012 breach was much bigger than first thought. More than 100 million email addresses and passwords from it were offered for sale. LinkedIn reset the password of every member who had not changed theirs since 2012. A Russian man, Yevgeniy Nikulin, was later convicted of the break-in.

Why it mattered

It showed that how a company stores passwords matters as much as keeping attackers out, and that stolen passwords keep their value for years. Many members had used the same password on other sites, so the leak put their other accounts at risk too, four years after the break-in.

The lesson today

Many people who never changed their LinkedIn password had also used it elsewhere. Four years later, the same password still opened those other accounts. Breaches can surface years after they happen. A unique password per site limits the damage, and multi-factor authentication means a leaked password is not enough by itself.