A LinkedIn hack from back in 2012 is still causing problems for its users. The company announced this morning that another data set from the hack, which contains over 100 million LinkedIn members’ emails and passwords, has now been released. In response to this new data dump, LinkedIn says it’s working to validate the accounts and contact affected users so they can reset their passwords on the site. 
 
 As you may or may not recall, given how much time has passed, hackers broke into LinkedIn’s network back in 2012, stole some 6.5 million encrypted passwords, and posted them onto a Russian hacker forum. Because the passwords were stored as unsalted SHA-1 hashes, hundreds of thousands were quickly cracked. 
 
 Now, according to a new report from Motherboard, a hacker going by the name of “Peace” is trying to sell the emails and passwords of 117 million LinkedIn members on a dark web illegal marketplace for around $2,200, payable in bitcoin. In total, the data set includes 167 million accounts, but of those, only 117 million or so have both emails and encrypted passwords. 
 
 As this data set also originates from the 2012 hack, these passwords are encrypted in the same way – with “no salt” – meaning they are more easily cracked. In fact, Motherboard states that 90 percent of the passwords were cracked within 72 hours. Several of the victims were still using their same password from 2012, the report also said. 
 
 Whether or not current LinkedIn users should be concerned comes down to a handful of factors: did you have an account during the time of the 2012 breach, have you changed your password since, and has that password been reused on other websites? 
 
 If you’re not sure, a best practice would be to change it anyway, as well as on other critical sites where you may be using that same password such as your banking website, email, or Facebook, for example. 
 
 LinkedIn says that it has increased its security measures in the years since the breach, by introducing stronger encryption, email challenges and two-factor authentication. But this hack was from an earlier era, before these protections were in place. They would also not necessarily protect users from hackers who had obtained email and password combinations. 
 
 The full text of LinkedIn’s statement is below: ||||| Quite literally, every day someone gets hacked. Whether that's a telecommunications company having its customer data stolen, or another chain of businesses being ripped for all the credit cards it processes, today one hack just seems to melt into another. 
 
 In our series Another Day, Another Hack, we do short posts giving you what you need to know about the hack, so you can figure out whether your bank account, website logins or anything else might be at risk. Because, even if the hack might not be the most sophisticated, real people are still getting fucked over somewhere, and should know about it. 
 
 A hacker is trying to sell the account information, including emails and passwords, of 117 million LinkedIn users. 
 
 The hacker, who goes by the name “Peace,” told Motherboard that the data was stolen during the LinkedIn breach of 2012. At the time, only around 6.5 million encrypted passwords were posted online, and LinkedIn never clarified how many users were affected by that breach. 
 
 Turns out it was much worse than anybody thought. 
 
 Peace is selling the data on the dark web illegal marketplace The Real Deal for 5 bitcoin (around $2,200). The paid hacked data search engine LeakedSource also claims to have obtained the data. Both Peace and the one of the people behind LeakedSource said that there are 167 million accounts in the hacked database. Of those, around 117 million have both emails and encrypted passwords. 
 
 “It is only coming to the surface now. People may not have taken it very seriously back then as it was not spread,” one of the people behind LeakedSource told me. “To my knowledge the database was kept within a small group of Russians.” 
 
 A screenshot of the listing on The Real Deal 
 
 LeakedSource provided Motherboard with a sample of almost one million credentials, which included email addresses, hashed passwords, and the corresponding hacked passwords. The passwords were originally encrypted or hashed with the SHA1 algorithm, with no “salt,” which is a series of random digits attached to the end of hashes to make them harder to be cracked. 
 
 One of the operators of LeakedSource told Motherboard in an online chat that so far they have cracked “90% of the passwords in 72 hours.” 
 
 Troy Hunt, a security researcher who maintains the breach notification site “Have I Been Pwned?,” reached out to some of the victims of the data breach. Two of them confirmed to Hunt that they indeed were users of LinkedIn and that the password he shared with them was the one they were using at the time of the breach. Motherboard was able to confirm a third victim. 
 
 One of the victims told Motherboard that the password in the sample was their current one, though he changed it as soon as Hunt reached out no notify him of the breach. 
 
 “Having a password out there feels like someone being able to let themselves in to your private space whenever they like, without you knowing,” the victim, who asked to remain anonymous, said in an email. 
 
 When reached for comment on Tuesday, LinkedIn spokesperson Hani Durzy told Motherboard that the company’s security team was looking into the incident, but that at the time they couldn’t confirm whether the data was legitimate. Durzy, however, also admitted that the 6.5 million hashes that were posted online in 2012 were not necessarily all of the passwords stolen. 
 
 “We don’t know how much was taken,” Durzy told me in a phone call. 
 
 The lesson: For LinkedIn, the lesson is the same as four years ago: don’t store passwords in an insecure way. As for LinkedIn users, if you didn’t already change your password four years ago, change it again, especially if you use it on other services (and please stop reusing passwords). 
 
 “The prevalence of password reuse means we’ll see that unlock other accounts too,” Hunt told me. 
 
 Another lesson is that even old hacked data can sometimes be valuable, given that some of these passwords might still be valid. 
 
 UPDATE, May 18, 12:32 p.m. ET: LinkedIn confirmed on Wednesday that the new data is legitimate. 
 
 “Yesterday, we became aware of an additional set of data that had just been released that claims to be email and hashed password combinations of more than 100 million LinkedIn members from that same theft in 2012,“ the company's chief information security officer Cory Scott wrote in a blog post. “We are taking immediate steps to invalidate the passwords of the accounts impacted, and we will contact those members to reset their passwords. We have no indication that this is as a result of a new security breach.“ 
 
 Scott also encouraged users to use two-factor authentication and use strong passwords. ||||| Login credentials for as many as 117 million LinkedIn accounts have been put up for sale online by someone who is seeking more than $2,200 for the haul, a security researcher said. 
 
 Further Reading 8 million leaked passwords connected to LinkedIn, dating website The credentials—which include e-mail addresses and passwords hashed using the woefully weak SHA1 function—appear to come from a 2012 breach of the career networking site, researcher Troy Hunt said in a series of tweets. LinkedIn officials have since verified that the 2012 hack was the source and said they are working to invalidate any passwords that may still be actively used on compromised accounts. According to LeakedSource, a site that maintains a database of more than 1.25 billion compromised accounts, the new batch contains data for 167 million accounts. 117 million of the records in the batch include a password field. 
 
 The discovery means that the 2012 LinkedIn breach was much bigger than previously believed. At the time, researchers found almost 6.5 million credentials belonging to site users. It's not clear if the new number of affected accounts is news to LinkedIn. In the days following discovery of the 2012 breach, company officials implemented a mandatory password reset for affected users. A statement from company officials on Wednesday saying that they're working to change any passwords still in use leaves open the possibility that they were unaware the number was so high. 
 
 According to posts on social media sites, the data was advertised on a dark Web site known as The Real Deal by someone with the user name peace_of_mind. It offers data for 167 million accounts for five bitcoins, which at current exchange rates is worth about $2,200. 
 
 In an e-mail, LinkedIn officials wrote: 
 
 In 2012, LinkedIn was the victim of an unauthorized access and disclosure of some members' passwords. At the time, our immediate response included a mandatory password reset for all accounts we believe were compromised as a result of the unauthorized disclosure. Additionally, we advised all members of LinkedIn to change their passwords as a matter of best practice. Yesterday, we became aware of an additional set of data that had just been released that claims to be email and hashed password combinations of LinkedIn members from that same theft in 2012. We are taking immediate steps to invalidate the passwords of the accounts impacted, and we will contact those members to reset their passwords. We have no indication that this is a result of a new security breach. We take the safety and security of our members' accounts seriously. For several years, we have hashed and salted every password in our database; and we have offered protection tools such as email challenges and dual factor authentication. We encourage our members to visit our 
 
 safety center to ensure they have two-step verification authentication and to use strong passwords in order to keep their accounts as safe as possible. 
 
 The LeakedSource post breaks down the most commonly used passwords and they reveal a stunning lack of care on the part of end users—and more to the point, on the part ofr LinkedIn for allowing them in the first place. The most widely used passcode was 123456, with 753,305 accounts. It was followed by linkedin with 172,523, password with 144,458, 123456789 with 94,314, 12345678 with 63,769, and 111111, with 57,210. Many sites are reluctant to forbid the use of such weak passwords out of a fear of alienating users. The leak underscores just how much a new approach is needed.
– In 2012, hackers posted 6.5 million stolen LinkedIn passwords to a Russian forum, TechCrunch reports. It turns out, that security breach was much bigger and much worse than possibly anyone realized. According to Motherboard, 117 million LinkedIn emails and passwords taken as part of the same breach were just put up for sale by a hacker named "Peace," who is seeking $2,200 for them on the dark web. LinkedIn has confirmed the emails and passwords are legit and is working on contacting affected users. Back in 2012, LinkedIn never specified how many accounts had been compromised by hackers. Ars Technica reports it's possible even the company didn't know how many passwords had been stolen initially. Hackers have apparently had no trouble with the lightly encrypted passwords. One source claims hackers cracked 90% of the stolen passwords within 72 hours. Ars Technica argues many of the passwords should never have been allowed by LinkedIn in the first place. More than 750,000 users had the password "123456." More than 170,000 used "linkedin." Other popular passwords were "password" and "111111." People who were using LinkedIn in 2012, still have the same password, and use that password for other websites should be concerned, according to TechCrunch, which says it's best to change your password on LinkedIn (and anywhere else you used it) just in case.