matrix100680471orig
Security

Last.fm breach from 2012 affected 43 million users

Stolen data obtained from music site Last.fm back in 2012 has surfaced, and it looks like hackers made off with accounts belonging to more than 43 million users.

That's according to LeakedSource, a repository for data breaches that obtained a copy of the stolen data. Included in the trove are users' names, email addresses and passwords secured with an aging hashing algorithm called MD5, LeakedSource reported in a blog post on Thursday.

Last.fm hasn’t responded so far to a request for comment. The music service reported the breach four years ago and asked all its users to change their passwords immediately. It never made clear how many accounts were affected, however, or the hashing method it used to secure the passwords.

LeakedSource said it obtained the stolen data from someone with the Jabber ID daykalif@xmpp.jp. Hackers have been regularly supplying the repository site with data taken from past breaches, partly to draw publicity to themselves.

A sample of the stolen data was provided and the information appears to be legitimate. LeakedSource said it took only two hours to crack more than 96 percent of the passwords from the database.

About 9 million of the accounts were registered with email addresses at hotmail.com, while another 8 million were at gmail.com.

Last.fm has been waning in popularity over the years. It’s currently the 1,765th most visited site in the world, down from 779th when the breach was detected in 2012, according to web traffic monitor Alexa.  

Still, hackers could have relied on the stolen data to attack other internet accounts, such as for affected users who reused their Last.fm passwords to register with other sites. 

News of the Last.fm breach comes as stolen data on 68 million Dropbox accounts has begun circulating more widely on the internet.

Anonymous hackers likely obtained that data also in 2012, meaning they had four years to exploit the stolen information before it became public. Security experts are urging affected users to change their passwords across all their internet accounts and to use two-factor authentication to secure them.

IDG Insider

PREVIOUS ARTICLE

« Windows 10 growth slowdown has bright side

NEXT ARTICLE

NSX, and its new chief, take center stage at VMWorld »
author_image
IDG News Service

The IDG News Service is the world's leading daily source of global IT news, commentary and editorial resources. The News Service distributes content to IDG's more than 300 IT publications in more than 60 countries.

  • Mail

Recommended for You

Trump hits partial pause on Huawei ban, but 5G concerns persist

Phil Muncaster reports on China and beyond

FinancialForce profits from PSA investment

Martin Veitch's inside track on today’s tech trends

Future-proofing the Middle East

Keri Allan looks at the latest trends and technologies

Poll

Do you think your smartphone is making you a workaholic?