2012 · Professional network

LinkedIn, 2012: 6.5 million hashes that turned into 165 million accounts

Case file · 4 min read · Published 14 September 2026

People affected: 165 million accounts (117 million with passwords)
When it happened: June 2012
Made public: 6 June 2012; full scale revealed May 2016
How they got in: Never fully detailed publicly; passwords stored as unsalted SHA-1
Attributed to: Yevgeniy Nikulin, convicted in a US federal court in 2020
What it cost: $1.25 million settlement with premium subscribers; a chain of secondary breaches at other companies

What was exposed: Email addresses · Unsalted SHA-1 password hashes

On 5 June 2012 someone posted a file of 6.5 million password hashes to a Russian password-cracking forum and asked for help with the ones they could not solve. The hashes were unsalted SHA-1. Within days, most of them were cracked, and LinkedIn confirmed the file was its own. It took another four years for anyone to learn that 6.5 million was a fraction of what had been taken.

What happened

LinkedIn's response in 2012 was the standard one: invalidate the affected passwords, email the users, and — belatedly — start salting and hashing properly. The company said 6.5 million accounts, because 6.5 million was what had appeared in public. The assumption everyone made, including LinkedIn, was that the leaked file was the extent of the theft.

In May 2016 a seller using the name "Peace" listed 167 million LinkedIn accounts on a dark-web market for five bitcoin. The file contained roughly 117 million email-and-password pairs. It was the same 2012 intrusion; the rest of the haul had simply sat unsold for four years.

That gap between a breach happening and a breach becoming fully known is the single most useful thing this case teaches. For four years, 110 million people had been told nothing was wrong with their account because nobody had yet chosen to sell their row.

Why the hashes fell so fast

SHA-1 is a cryptographic hash function built for speed — it exists to verify that a file has not changed, and it is very good at that. Speed is precisely the wrong property for password storage. A consumer graphics card can compute billions of SHA-1 hashes per second, so an attacker holding a list of hashes can simply try every word in a dictionary, every leaked password from every previous breach, and every plausible mutation of both.

The missing salt made it worse. A salt is a unique random value stored with each user and mixed into the hash, so that two people who both choose linkedin123 end up with completely different stored values. Without it, one cracking run answers for everybody at once: crack the hash for linkedin123 once, and every account that used it falls simultaneously.

What proper storage looks like. A password-specific algorithm — bcrypt, scrypt or Argon2 — with a per-user salt and a cost factor tuned so that a single guess takes a measurable fraction of a second. That turns "billions of guesses per second" into "a few thousand", which is the difference between a file cracked over a weekend and a file that is not worth attacking. LinkedIn moved to salted hashing after 2012; the 2016 file was still the old format, because it was taken before the change.

The damage other companies took

LinkedIn is the clearest case of a breach whose worst consequences landed somewhere else entirely.

Dropbox. A Dropbox employee had reused their LinkedIn password on a corporate account. Attackers used it to reach an internal system, and 68 million Dropbox credentials were taken. That file also surfaced in 2016.

Mark Zuckerberg. In June 2016 his Twitter and Pinterest accounts were taken over. The password reportedly came from the LinkedIn set and was, famously, dadada.

Everyone else. Once a hundred million real email-and-password pairs are in circulation, they become the fuel for credential stuffing: automated login attempts against banks, mailboxes, retailers and games, on the basis that a sizeable fraction of people reuse. The LinkedIn set has been folded into every large combination list since.

The timeline

5 June 2012 — 6.5 million unsalted SHA-1 hashes are posted to a cracking forum.
6 June 2012 — LinkedIn confirms the breach and begins resetting passwords.
2012–2013 — LinkedIn moves to salted hashing and adds optional two-factor authentication.
17 May 2016 — 167 million accounts are listed for sale; the true scale becomes clear.
June 2016 — Secondary account takeovers begin, including high-profile social media accounts.
October 2016 — Yevgeniy Nikulin is arrested in Prague at the request of the United States.
2020 — Nikulin is convicted of the intrusions at LinkedIn, Dropbox and Formspring and sentenced to 88 months.

What it changed

Three things came out of this case that are now simply how the industry works.

Salting stopped being optional. LinkedIn in 2012 was not an outlier — unsalted fast hashes were common. It became the example used to end the argument, and by the mid-2010s a security review that found unsalted SHA-1 treated it as a finding rather than a preference.

Breach numbers are provisional. The gap between 6.5 million and 165 million taught researchers to treat the first public figure as a floor, not a total. Have I Been Pwned's practice of revising records years later exists because of cases like this one.

Employee password reuse became a corporate risk, not a personal one. The Dropbox chain is the standard argument for enforcing password managers and phishing-resistant two-factor authentication on staff accounts: your company's security now depends on where your engineers signed up in 2011.

If you had a LinkedIn account before 2012

The password is public. Assume it was cracked, because it almost certainly was. If any variation of it is still in use, replace it.
Look for reuse, not just at LinkedIn. The value of this file to an attacker is what it opens elsewhere. Work through the accounts that matter — email first, then banking, then anything holding payment details.
Turn on two-factor authentication. It is what makes a leaked password survivable. The differences between SMS, app codes and security keys matter here.
Remember the scraped data is separate. Your public profile has also been copied wholesale into datasets that are traded openly; nothing about a password change touches that. Decide deliberately what your profile shows.

Questions people ask

How many LinkedIn accounts were breached?

Around 165 million, of which roughly 117 million had a usable email-and-password pair. Only 6.5 million hashes appeared in 2012; the rest surfaced in May 2016 when the full file was offered for sale.

What is an unsalted SHA-1 hash, and why was it a problem?

SHA-1 is a fast hashing algorithm designed for checking file integrity, not for storing passwords — modern hardware tests billions of candidates per second. "Unsalted" means no random value was mixed into each password, so identical passwords produced identical hashes and one cracking run solved every account that shared a password. A password-specific algorithm with a per-user salt would have made the same file close to worthless.

Was the 2021 "700 million LinkedIn records" leak the same thing?

No. That dataset was scraped from public profiles using LinkedIn's own interfaces, not taken from its databases, and it contained no passwords. It is a real privacy problem but a different category of event — no security control was bypassed, which is what makes scraping so hard to prevent.

Did the LinkedIn breach cause other breaches?

Directly. A Dropbox employee reused their LinkedIn password on a corporate account, which led to the theft of 68 million Dropbox credentials. Mark Zuckerberg's Twitter and Pinterest accounts were taken over in 2016 using a password from the LinkedIn set. Reuse is what turns one company's failure into everyone's.

Sources

LinkedIn security notices, June 2012 and May 2016
US Department of Justice — conviction of Yevgeniy Nikulin, 2020
In re LinkedIn User Privacy Litigation — $1.25 million settlement, 2015
Have I Been Pwned — LinkedIn breach record