MyRecon OSINTMySpace, 2016: 360 million accounts from a website nobody used any more
MySpace data breach
The MySpace passwords were years old and the site was long abandoned. That is exactly why the breach worked, abandoned accounts still hold passwords people reuse.
Follow the timeline ↓
- People affected
- about 360 million accounts
- When it happened
- Around 2008; surfaced May 2016
- Made public
- May 2016
- How they got in
- Never publicly detailed; passwords stored as unsalted SHA-1 of the first ten characters, lowercased
- Attributed to
- Offered for sale by a seller using the name Peace, the same handle that sold the LinkedIn and Tumblr data
What was exposed: Email addresses · Usernames · Unsalted SHA-1 password hashes
How the story unfolded
Open a step to read the detail. Missing dates stay unknown.
01SHA-1, unsalted.
Fast to compute and identical for identical inputs, so one cracking run resolves every account sharing a password.
02Lowercased.
Capitalisation was discarded before hashing, collapsing the search space.
03Truncated to ten characters.
Only the first ten characters were used. A careful user with a 24-character passphrase was protected by the first ten characters of it, in lowercase.
The story behind the breach
When roughly 360 million MySpace accounts appeared for sale in May 2016, the reaction in most places was amusement. MySpace? The data was eight years old, from a site that had been culturally irrelevant for most of a decade. The amusement was misplaced: it was the largest breach loaded into public breach databases at the time, and its age was the point rather than the punchline.
How did it happen?
Never publicly detailed; passwords stored as unsalted SHA-1 of the first ten characters, lowercased
What was the motive?
The published account does not establish the motive. We cannot tell what the attackers intended from the exposed data alone.
Claims and demands are reported as such; they do not establish every attacker's intention.
What was the outcome?
Reported scale: about 360 million accounts.
Read the full account and timeline · 3 min
When roughly 360 million MySpace accounts appeared for sale in May 2016, the reaction in most places was amusement. MySpace? The data was eight years old, from a site that had been culturally irrelevant for most of a decade. The amusement was misplaced: it was the largest breach loaded into public breach databases at the time, and its age was the point rather than the punchline.
What happened
The dataset contained email addresses, usernames and password hashes for accounts dating to around 2008. It surfaced in the same 2016 wave that brought the full LinkedIn file and the Tumblr data to market, offered by the same seller, a period when several enormous old breaches were monetised at once.
MySpace, by then owned by Time Inc., invalidated passwords for affected accounts. For most users this was a notification about a service they had forgotten they had.
The password storage, which was remarkable
The hashing scheme deserves its own paragraph because it manages three separate failures simultaneously:
- SHA-1, unsalted. Fast to compute and identical for identical inputs, so one cracking run resolves every account sharing a password.
- Lowercased. Capitalisation was discarded before hashing, collapsing the search space.
- Truncated to ten characters. Only the first ten characters were used. A careful user with a 24-character passphrase was protected by the first ten characters of it, in lowercase.
What truncation destroys. Every additional character in a password multiplies the work an attacker must do. Truncating at ten caps that work at a fixed, modest ceiling regardless of what the user chose, which means the site silently overrode its most security-conscious users. If you ever wonder why security people are suspicious of undocumented password length limits, this is the reason: a limit usually implies something is being done to the password before it is stored.
Why old breaches keep working
The value of a fifteen-year-old password file rests on a simple, well-evidenced fact about people: passwords are sticky. Someone who chose a password in 2008 often still uses it, or a version with a digit incremented, or the same base word with a different site's name appended. Human-generated passwords evolve; they rarely get replaced.
Meanwhile the account itself sits abandoned. No one monitors it, no one receives its notifications, often the registered email address is itself defunct, and no one ever changes its password because they have no reason to think about it.
That combination is why the MySpace file went straight into combination lists and is still being tried against banks and mailboxes today. It is also why the honest answer to "should I worry about a breach at a site I stopped using?" is yes, if you ever reused that password.
The other MySpace data loss
Worth recording alongside it: in 2019 MySpace confirmed that a server migration had destroyed roughly twelve years of user-uploaded music, photos and video, an estimated fifty million tracks from fourteen million artists, gone with no recoverable backup.
That is not a breach, and it belongs here anyway, because it is the other half of the same lesson. Handing your only copy of something to a platform means accepting its retention decisions, its migration competence and its survival. Availability failures rarely make the news the way breaches do, and for the person who lost the only recording of a song they wrote, the outcome is worse.
What to do about accounts you abandoned
Questions people ask
Why does a breach of an abandoned site matter?
Because the password is not abandoned. People who used a password on MySpace in 2008 frequently used it, or a small variation of it, on accounts they still hold. The site's irrelevance is what makes it dangerous: nobody thinks to change a password for a service they have not opened in fifteen years.
What was wrong with how the passwords were stored?
Three things at once. SHA-1 is fast, so guessing is cheap. There was no salt, so identical passwords produced identical hashes and one crack solved many accounts. And only the first ten characters were used, lowercased, so a 20-character password with careful capitalisation was reduced to ten lowercase characters before hashing.
When did the breach actually happen?
The data dates to around 2008, but it did not surface publicly until May 2016, when it was offered for sale alongside other large old datasets. Eight years is a long time for data to circulate privately, and it is a good reason to treat every old password as compromised regardless of whether you have heard of a breach.
Is MySpace data still being used?
Yes, indirectly. It was absorbed into the combination lists used for credential stuffing, so those email-and-password pairs are still tried automatically against current services.
Sources
- Time Inc. statement on the MySpace account data, May 2016
- Have I Been Pwned, MySpace breach record
- LeakedSource analysis of the dataset, 2016
Read next
Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported, where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.