Last.fm data breach (2012)

In March 2012, the UK-based music-streaming and scrobbling service Last.fm was hacked and its user database stolen. Last.fm warned users of a possible incident at the time, but the full scale — more than 43 million accounts — only became public in September 2016, when the dataset surfaced as part of that year's wave of historical mega breaches.

What happened

The intrusion occurred on or around 22 March 2012. On 7 June 2012, Last.fm posted a security notice urging users to change their passwords "as a precautionary measure" following a possible breach, but it did not quantify the exposure. For four years the incident was treated as a minor episode.

That assessment collapsed in September 2016, when the breach-notification service LeakedSource obtained a copy of the database and shared its analysis with TechCrunch. The dataset contained well over 43 million records, dwarfing earlier assumptions about the breach's size.

What was exposed

Each record included a username, email address, password, join date, and assorted internal Last.fm service data (such as newsletter and account metadata). Critically, the passwords were stored as unsalted MD5 hashes — a fast, weak scheme with no per-user salt.

The consequences were stark. Because the hashes were unsalted MD5, researchers reported cracking over 96% of the passwords in roughly two hours. The single most common password recovered was "123456," underscoring both the weak hashing and weak user password choices.

Impact

• 43,570,999 accounts exposed (Have I Been Pwned indexes 37,217,682 unique email addresses from the set).
• Near-total password recovery thanks to unsalted MD5, exposing users to credential stuffing wherever they had reused the same password.
• Email addresses and usernames fed downstream phishing and spam.

Why it matters

Last.fm is a textbook example of why unsalted MD5 was already considered unacceptable for password storage by 2012, and of the danger of under-disclosing breach scope. The contrast with Tumblr — breached the same era but using salted SHA-1 — is instructive: similar attacks produced wildly different outcomes for users based on hashing design alone. The four-year gap between the 2012 incident and the 2016 revelation also meant millions of reused passwords remained exploitable long after the original theft.