A hacker is trying to sell the account information, including emails and passwords, of 117 million LinkedIn users. The hacker, who goes by the name “Peace,” told Motherboard that the data was stolen during the LinkedIn breach of 2012. As you may or may not recall, given how much time has passed, hackers broke into LinkedIn’s network back in 2012, stole some 6.5 million encrypted passwords, and posted them onto a Russian hacker forum. Now, according to a new report from Motherboard, a hacker going by the name of “Peace” is trying to sell the emails and passwords of 117 million LinkedIn members on a dark web illegal marketplace for around $2,200, payable in bitcoin. According to LeakedSource, a site that maintains a database of more than 1.25 billion compromised accounts, the new batch contains data for 167 million accounts. Login credentials for as many as 117 million LinkedIn accounts have been put up for sale online by someone who is seeking more than $2,200 for the haul, a security researcher said. The passwords were originally encrypted or hashed with the SHA1 algorithm, with no “salt,” which is a series of random digits attached to the end of hashes to make them harder to be cracked. One of the operators of LeakedSource told Motherboard in an online chat that so far they have cracked “90% of the passwords in 72 hours.” 
 
 Troy Hunt, a security researcher who maintains the breach notification site “Have I Been Pwned?,” reached out to some of the victims of the data breach. Further Reading 8 million leaked passwords connected to LinkedIn, dating website The credentials—which include e-mail addresses and passwords hashed using the woefully weak SHA1 function—appear to come from a 2012 breach of the career networking site, researcher Troy Hunt said in a series of tweets. Whether or not current LinkedIn users should be concerned comes down to a handful of factors: did you have an account during the time of the 2012 breach, have you changed your password since, and has that password been reused on other websites? When reached for comment on Tuesday, LinkedIn spokesperson Hani Durzy told Motherboard that the company’s security team was looking into the incident, but that at the time they couldn’t confirm whether the data was legitimate. As for LinkedIn users, if you didn’t already change your password four years ago, change it again, especially if you use it on other services (and please stop reusing passwords). “Yesterday, we became aware of an additional set of data that had just been released that claims to be email and hashed password combinations of more than 100 million LinkedIn members from that same theft in 2012,“ the company's chief information security officer Cory Scott wrote in a blog post. At the time, our immediate response included a mandatory password reset for all accounts we believe were compromised as a result of the unauthorized disclosure. We encourage our members to visit our 
 
 safety center to ensure they have two-step verification authentication and to use strong passwords in order to keep their accounts as safe as possible.
– In 2012, hackers posted 6.5 million stolen LinkedIn passwords to a Russian forum, TechCrunch reports. It turns out, that security breach was much bigger and much worse than possibly anyone realized. According to Motherboard, 117 million LinkedIn emails and passwords taken as part of the same breach were just put up for sale by a hacker named "Peace," who is seeking $2,200 for them on the dark web. LinkedIn has confirmed the emails and passwords are legit and is working on contacting affected users. Back in 2012, LinkedIn never specified how many accounts had been compromised by hackers. Ars Technica reports it's possible even the company didn't know how many passwords had been stolen initially. Hackers have apparently had no trouble with the lightly encrypted passwords. One source claims hackers cracked 90% of the stolen passwords within 72 hours. Ars Technica argues many of the passwords should never have been allowed by LinkedIn in the first place. More than 750,000 users had the password "123456." More than 170,000 used "linkedin." Other popular passwords were "password" and "111111." People who were using LinkedIn in 2012, still have the same password, and use that password for other websites should be concerned, according to TechCrunch, which says it's best to change your password on LinkedIn (and anywhere else you used it) just in case.