[BreachExchange] Data scraped from 500 million LinkedIn users found for sale online

[Destry Winant]

https://www.techrepublic.com/article/data-scraped-from-500-million-linkedin-users-found-for-sale-online/

A massive trove of LinkedIn account data has been found for sale
online, containing 500 million user records including email addresses,
phone numbers, links to other social media profiles and professional
details.

More about cybersecurity

Reported by CyberNews researchers, the leak was posted to a forum
popular with hackers by a user asking for a "four-digit $$$$ minimum
price" for access to the full database of stolen account information.

To prove the legitimacy of the info, the leaker included two million
records as a sample that users on the form can view for $2 worth of
forum-specific credits. CyberNews researchers were able to confirm
that the data contained in the sample was legitimate, but added that "
it's unclear whether the threat actor is selling up-to-date LinkedIn
profiles, or if the data has been taken or aggregated from a previous
breach suffered by LinkedIn or other companies."

Included in the leaked data was "a variety of mostly professional
information," including LinkedIn IDs, full names, email addresses,
phone numbers, user gender, links to LinkedIn profiles, links to other
connected social media profiles, professional titles and other
work-related data. The leaked data doesn't appear to contain any
credit card or other financial details, or legal documents that could
be used for fraud.

The lack of financial or identification documentation doesn't mean the
leaked data isn't dangerous, though. "Particularly determined
attackers can combine information found in the leaked files with other
data breaches in order to create detailed profiles of their potential
victims. With such information in hand, they can stage much more
convincing phishing and social engineering attacks or even commit
identity theft against the people whose information has been exposed
on the hacker forum," CyberNews said.

LinkedIn describes itself as having nearly 740 million users; if the
leaker selling this batch of stolen data is telling the truth, then
it's safe to assume anyone with a LinkedIn account could be among the
500 million leaked records. With that in mind, LinkedIn users should
take precautions to protect their accounts and their personal data by:

- Changing LinkedIn account passwords and email account passwords
associated with LinkedIn profiles.
- Creating a strong, random, unique password, and storing it in a
password manager that can auto-fill logins.
- Enabling two-factor authentication (2FA) on LinkedIn accounts and
any other account that offers 2FA.
- Being wary of LinkedIn messages and connection requests from unknown people.
- Learning to identify phishing emails and text messages.
- Never opening links to websites from an email, and instead
navigating to a site manually and logging in there.
- Installing strong anti-phishing and anti-malware software.

In addition to taking proper precautions with your security, it's also
a good idea to subscribe to a website like Have I Been Pwned, which
will notify you if your email address is found in a data breach that
it has scanned and added to its master database of compromised
accounts. If your information appears in a Have I Been Pwned search,
it's important to take action immediately using the above security
tips.