Personal Data of 700 Million LinkedIn Users Put Up for Sale on Dark Web
Security researchers have reported that the user data of a staggering 700 million LinkedIn users has been put up for sale on an underground hacker forum. This leak takes place hot on the heels of the mid-April leak when half a billion LinkedIn user accounts were leaked online.
The original report came from cyber security researchers working with Privacy Sharks. They reported spotting the LinkedIn user data dump put up for sale on a dark web forum called RaidForums. The user who put up the data dump for sale goes by the handle of 'GOD User TomLiner'.
The whole data set includes a purported 700 million user records and the hacker has already put up a whole million up for grabs as a free sample and as proof of his hack.
When researchers obtained the free data set put up by the hacker, they discovered that the leaked data includes all the personally identifiable data you can imagine, including full names, emails, gender, phone numbers as well as information about the industry each LinkedIn user works in. There is no hard evidence how the data set was obtained, but researchers believe it may have been done using tools to scrape information off public user profiles.
The same scraping method was used to obtain the data for the 500 million accounts that was leaked back in April 2021. However, just as they reported back in April, LinkedIn once again states that there is no evidence of their systems and networks being breached.
The company believes that the information has been scraped off public-facing profiles as well as obtained from "other sources". The company further stated that there has not been a data breach of their databases and servers and no user data flagged as private has been leaked. Of course, LinkedIn also reminded users that scraping data in this way is a violation of the platform's terms of service.
The additional 200 million records that appear in this new data set are indication that it might be a rehash of a significant chunk of the previously leaked data, with newly scraped records added on top.
Even though there is no exposure of information that users had flagged as private on their profiles, similar data packages are usually sold to bad actors who deal in phishing, so this incident still presents some level of dangerous exposure. Additionally, credential stuffing, impersonation and identity theft as well as various scams and fraud campaigns are also on the table, once this data set ends up in the hands of bad actors.
Finally, LinkedIn users targeted by hackers may also become potential victims of malicious and fake job offers laced with malware, and those attacks can be highly personalized when all this data is available.
