LinkedIn, 2012: 6.5 million hashes that turned into 165 million accounts

On 5 June 2012 someone posted a file of 6.5 million password hashes to a Russian password-cracking forum and asked for help with the ones they could not solve. The hashes were unsalted SHA-1. Within days, most of them were cracked, and LinkedIn confirmed the file was its own. It took another four years for anyone to learn that 6.5 million was a fraction of what had been taken.

What happened

LinkedIn's response in 2012 was the standard one: invalidate the affected passwords, email the users, and, belatedly, start salting and hashing properly. The company said 6.5 million accounts, because 6.5 million was what had appeared in public. The assumption everyone made, including LinkedIn, was that the leaked file was the extent of the theft.

In May 2016 a seller using the name "Peace" listed 167 million LinkedIn accounts on a dark-web market for five bitcoin. The file contained roughly 117 million email-and-password pairs. It was the same 2012 intrusion; the rest of the haul had simply sat unsold for four years.

That gap between a breach happening and a breach becoming fully known is the single most useful thing this case teaches. For four years, 110 million people had been told nothing was wrong with their account because nobody had yet chosen to sell their row.

Why the hashes fell so fast

SHA-1 is a cryptographic hash function built for speed, it exists to verify that a file has not changed, and it is very good at that. Speed is precisely the wrong property for password storage. A consumer graphics card can compute billions of SHA-1 hashes per second, so an attacker holding a list of hashes can simply try every word in a dictionary, every leaked password from every previous breach, and every plausible mutation of both.

The missing salt made it worse. A salt is a unique random value stored with each user and mixed into the hash, so that two people who both choose linkedin123 end up with completely different stored values. Without it, one cracking run answers for everybody at once: crack the hash for linkedin123 once, and every account that used it falls simultaneously.

The damage other companies took

LinkedIn is the clearest case of a breach whose worst consequences landed somewhere else entirely.

Dropbox. A Dropbox employee had reused their LinkedIn password on a corporate account. Attackers used it to reach an internal system, and 68 million Dropbox credentials were taken. That file also surfaced in 2016.

Mark Zuckerberg. In June 2016 his Twitter and Pinterest accounts were taken over. The password reportedly came from the LinkedIn set and was, famously, dadada.

Everyone else. Once a hundred million real email-and-password pairs are in circulation, they become the fuel for credential stuffing: automated login attempts against banks, mailboxes, retailers and games, on the basis that a sizeable fraction of people reuse. The LinkedIn set has been folded into every large combination list since.

The timeline

1. 5 June 2012: 6.5 million unsalted SHA-1 hashes are posted to a cracking forum.
2. 6 June 2012: LinkedIn confirms the breach and begins resetting passwords.
3. 2012–2013: LinkedIn moves to salted hashing and adds optional two-factor authentication.
4. 17 May 2016: 167 million accounts are listed for sale; the true scale becomes clear.
5. June 2016: Secondary account takeovers begin, including high-profile social media accounts.
6. October 2016: Yevgeniy Nikulin is arrested in Prague at the request of the United States.
7. 2020: Nikulin is convicted of the intrusions at LinkedIn, Dropbox and Formspring and sentenced to 88 months.

What it changed

Three things came out of this case that are now simply how the industry works.

Salting stopped being optional. LinkedIn in 2012 was not an outlier, unsalted fast hashes were common. It became the example used to end the argument, and by the mid-2010s a security review that found unsalted SHA-1 treated it as a finding rather than a preference.

Breach numbers are provisional. The gap between 6.5 million and 165 million taught researchers to treat the first public figure as a floor, not a total. Have I Been Pwned's practice of revising records years later exists because of cases like this one.

Employee password reuse became a corporate risk, not a personal one. The Dropbox chain is the standard argument for enforcing password managers and phishing-resistant two-factor authentication on staff accounts: your company's security now depends on where your engineers signed up in 2011.

If you had a LinkedIn account before 2012