500M LinkedIn Users Data Posted for Sale Online
Personal data from more than 500 million LinkedIn users has been posted for sale online in another incident of hackers stealing data from public profiles and putting it online for other hackers. Hackers posted an archive containing data they said includes LinkedIn IDs, full names, professional titles, email addresses, phone numbers and other personally identifiable information on a popular hacker forum, according to a report in CyberNews.
The data also includes links to LinkedIn profiles and other social-media profiles, according to the report. To prove the authenticity of the info and provide a teaser of the data inside, the hackers also leaked another 2 million records as a proof-of-concept sample. Users on the forum can view the samples for about $2 worth of forum credits. However, the hackers also appear to be auctioning off the meat of the data-gathering, the 500 million user database, with a four-digit price tag. The reason for the low asking price is that the leaked data contains no payment card details and no passwords. It's of less value to hackers. it does contain valuable personal information like workplace info, email, social account links, which still has some value.
LinkedIn confirmed that data from the platform was included in the database and said it was not due to a breach of its system but instead was scraped from the LinkedIn site. Scraping is a common method used by hackers to siphon public information from the internet that can then be sold online for profit and reused for malicious activity. Scraped data is often repurposed to create socially engineered phishing attacks, to commit identity theft, brute-force credentials or spam victims' accounts.
LinkedIn may face regulatory troubles due to the incident, such as being in violation of the General Data Protection Rule. The GDPR is a European Union rule that went into effect in May 2018 that mandates that companies disclose data breaches within a certain period of time or face penalties. Facebook currently faces an investigation by Ireland's Data Protection Commission (IDPC) over the earlier leak. CyberNews has posted an online tool so people can check to see if their data was leaked in the most recent LinkedIn incident. If so, they should be careful when opening emails or text messages or links related to messages from senders they don't recognize.