MyRecon OSINT

← Case Files · The Breach Files

2008 · Social network

MySpace, 2016: 360 million accounts from a website nobody used any more

Case file · 3 min read · Published 14 September 2026

People affected
about 360 million accounts
When it happened
Around 2008; surfaced May 2016
Made public
May 2016
How they got in
Never publicly detailed; passwords stored as unsalted SHA-1 of the first ten characters, lowercased
Attributed to
Offered for sale by a seller using the name Peace, the same handle that sold the LinkedIn and Tumblr data

What was exposed: Email addresses · Usernames · Unsalted SHA-1 password hashes

When roughly 360 million MySpace accounts appeared for sale in May 2016, the reaction in most places was amusement. MySpace? The data was eight years old, from a site that had been culturally irrelevant for most of a decade. The amusement was misplaced: it was the largest breach loaded into public breach databases at the time, and its age was the point rather than the punchline.

What happened

The dataset contained email addresses, usernames and password hashes for accounts dating to around 2008. It surfaced in the same 2016 wave that brought the full LinkedIn file and the Tumblr data to market, offered by the same seller — a period when several enormous old breaches were monetised at once.

MySpace, by then owned by Time Inc., invalidated passwords for affected accounts. For most users this was a notification about a service they had forgotten they had.

The password storage, which was remarkable

The hashing scheme deserves its own paragraph because it manages three separate failures simultaneously:

  1. SHA-1, unsalted. Fast to compute and identical for identical inputs, so one cracking run resolves every account sharing a password.
  2. Lowercased. Capitalisation was discarded before hashing, collapsing the search space.
  3. Truncated to ten characters. Only the first ten characters were used. A careful user with a 24-character passphrase was protected by the first ten characters of it, in lowercase.

What truncation destroys. Every additional character in a password multiplies the work an attacker must do. Truncating at ten caps that work at a fixed, modest ceiling regardless of what the user chose — which means the site silently overrode its most security-conscious users. If you ever wonder why security people are suspicious of undocumented password length limits, this is the reason: a limit usually implies something is being done to the password before it is stored.

Why old breaches keep working

The value of a fifteen-year-old password file rests on a simple, well-evidenced fact about people: passwords are sticky. Someone who chose a password in 2008 often still uses it, or a version with a digit incremented, or the same base word with a different site's name appended. Human-generated passwords evolve; they rarely get replaced.

Meanwhile the account itself sits abandoned. No one monitors it, no one receives its notifications — often the registered email address is itself defunct — and no one ever changes its password because they have no reason to think about it.

That combination is why the MySpace file went straight into combination lists and is still being tried against banks and mailboxes today. It is also why the honest answer to "should I worry about a breach at a site I stopped using?" is yes, if you ever reused that password.

The other MySpace data loss

Worth recording alongside it: in 2019 MySpace confirmed that a server migration had destroyed roughly twelve years of user-uploaded music, photos and video — an estimated fifty million tracks from fourteen million artists, gone with no recoverable backup.

That is not a breach, and it belongs here anyway, because it is the other half of the same lesson. Handing your only copy of something to a platform means accepting its retention decisions, its migration competence and its survival. Availability failures rarely make the news the way breaches do, and for the person who lost the only recording of a song they wrote, the outcome is worse.

What to do about accounts you abandoned

  1. List the services you used before about 2015 — forums, games, social networks, shopping sites. Most people can name fifteen in five minutes, which is fifteen more than they were thinking about.
  2. Check which of them have appeared in breaches, using the addresses you had then — how to do that safely.
  3. Retire the password family, not just one password. If your 2008 password was a word plus a number, every variation on that theme should be considered known.
  4. Close what you can, and secure what you cannot. Where deletion is not offered, change the password, remove saved payment details, and unlink recovery addresses you still use for anything important.

Checked against every breach on record, against public breach data only. Your address is not sent to us as a form and is not stored — it is handed straight to the lookup tool in your own browser. See the privacy policy.

Questions people ask

Why does a breach of an abandoned site matter?

Because the password is not abandoned. People who used a password on MySpace in 2008 frequently used it, or a small variation of it, on accounts they still hold. The site's irrelevance is what makes it dangerous: nobody thinks to change a password for a service they have not opened in fifteen years.

What was wrong with how the passwords were stored?

Three things at once. SHA-1 is fast, so guessing is cheap. There was no salt, so identical passwords produced identical hashes and one crack solved many accounts. And only the first ten characters were used, lowercased — so a 20-character password with careful capitalisation was reduced to ten lowercase characters before hashing.

When did the breach actually happen?

The data dates to around 2008, but it did not surface publicly until May 2016, when it was offered for sale alongside other large old datasets. Eight years is a long time for data to circulate privately, and it is a good reason to treat every old password as compromised regardless of whether you have heard of a breach.

Is MySpace data still being used?

Yes, indirectly. It was absorbed into the combination lists used for credential stuffing, so those email-and-password pairs are still tried automatically against current services.

Sources

Read next

Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.

← All case files Breach archive →