500 Million LinkedIn Users’ Data is for Sale on a Hacker Site

Only a couple of days ago, Facebook was involved in a massive data breach that compromised the personal data of 533 million users. While the world was still grappling with the Facebook data breach, the news of another huge data leak involving the leading professional networking platform LinkedIn jostled the world. As per reports, over 500 million LinkedIn users’ data were compromised in a huge data leak.

Information scraped from around 500 million LinkedIn user profiles is part of a database posted for sale on a website popular with hackers, the company confirmed Thursday. The sale of the data was first reported on Tuesday by cybersecurity news and research site CyberNews, which said that an archive including user IDs, names, email addresses, phone numbers, genders, professional titles, and links to other social media profiles was being auctioned off on the forum for a four-figure sum.

According to LinkedIn, the database for sale “is actually an aggregation of data from a number of websites and companies.” The data from LinkedIn users includes only information that people listed publicly in their profiles, the professional social media site, which is owned by Microsoft, said in a Thursday statement.

“This is not a LinkedIn data breach, and no private member account data from LinkedIn was included in what we’ve been able to review,” the company said. The news comes just days after a separate incident in which data scraped from more than 500 million Facebook users in 2019 — including phone numbers, birthdays, emails, and other information — was posted publicly on a website used by hackers.

While these kinds of data are less sensitive than, say, credit card details or social security numbers, information like phone numbers can still be exploited by bad actors, including for robocall scams. LinkedIn has more than 675 million members, according to its website, meaning that around three-quarters of its users’ information may be included in the database.

Social media companies have tools in place aimed at preventing scrapers — LinkedIn on its terms page details “technical measures and defenses” against such abuse — but they don’t always work.

The company said that “any misuse of our members’ data, such as scraping” violates its terms of service, which prohibit third-party software, bots, browser extensions, or plug-ins that scrape data from the site.”When anyone tries to take member data and use it for purposes LinkedIn and our members haven’t agreed to, we work to stop them and hold them accountable,” LinkedIn said in its statement.

LinkedIn has yet to tell us if it will notify users whose data was in the dataset. (Facebook, if you were wondering, doesn’t plan to inform users if they are one of the people whose data leaked.) If you want to check whether your email or phone number was part of the Facebook data leak, we have instructions here. Italy’s privacy watchdog has started an investigation into LinkedIn, it confirmed to Bloomberg.