LinkedIn password breach

On 5 June 2012, roughly 6.5 million LinkedIn password hashes appeared on a Russian hacking forum, prompting the professional network to reset affected accounts. What looked at the time like a contained incident proved, four years later, to be one of the largest credential breaches of the era: the full haul covered 117 million accounts, dormant until it surfaced for sale on the dark web in 2016.

What happened

In May 2012, the Russian national Yevgeniy Nikulin compromised the computer of a LinkedIn employee and installed malware that captured the employee's credentials. Using that privileged access, he reached LinkedIn's internal user database and exfiltrated email addresses and password hashes.

LinkedIn had stored passwords as unsalted SHA-1 hashes. SHA-1 is a fast hashing algorithm, and without a per-user salt, identical passwords produce identical hashes — making large-scale cracking with precomputed tables and dictionaries trivial. After the 6.5 million hashes were published, researchers cracked the vast majority within days.

How the full scope emerged

In May 2016, a seller using the handle "Peace" advertised 117 million LinkedIn email-and-password combinations — the rest of the 2012 haul — for about 5 bitcoin (~$2,200 at the time) on a dark-web marketplace. LinkedIn confirmed the data was authentic and invalidated passwords for every account that had not changed its credentials since 2012. The same actor was simultaneously selling data from the MySpace and Tumblr breaches, all part of a wave of "mega-breach" dumps that reached the public market in 2016.

Impact

• 117 million accounts had email addresses and crackable password hashes exposed.
• Because so many users reused passwords, the credentials fueled years of credential-stuffing attacks against other services; several high-profile account takeovers (including Mark Zuckerberg's social-media accounts) were traced to reused LinkedIn passwords.
• Nikulin was arrested in Prague in October 2016, extradited to the United States, and in July 2020 convicted of the LinkedIn, Dropbox, and Formspring intrusions. He was sentenced to 88 months in prison.

Why it matters

LinkedIn is the textbook case for two enduring lessons. First, password storage matters: unsalted SHA-1 turned a database theft into a near-complete credential compromise. Modern practice mandates slow, salted algorithms such as bcrypt, scrypt, or Argon2 precisely to make this kind of mass cracking infeasible.

Second, the true scope of a breach can lie dormant for years. The gap between the 6.5 million figure reported in 2012 and the 117 million confirmed in 2016 showed that initial disclosures often understate the damage, and that stolen credentials retain value long after the original intrusion. The episode helped accelerate industry adoption of multi-factor authentication and breach-monitoring services like Have I Been Pwned, which ingested the LinkedIn data as one of its defining datasets.