LinkedIn investigates leak of 6m passwords

 

Gallery

By Nicole Kobie

Posted on 6 Jun 2012 at 16:38

LinkedIn is investigating reports that more than six million passwords have been leaked online.

"Our team continues to investigate, but at this time, we're still unable to confirm that any security breach has occurred," said the social network in a statement. LinkedIn has 161m users worldwide.

Update: LinkedIn has since confirmed "that some of the passwords that were compromised correspond to LinkedIn accounts", and said all passwords for affected accounts have been changed. Any affected users will receive an email from the company with details on how to reset their password.

Security firm Sophos said its own research suggests real passwords are contained in the leaked collection. However, the passwords are protected by hashing, which will make them tougher to crack - unless the password used was a common dictionary word. Other login details, such as email addresses, haven't been leaked.

It's important for LinkedIn users to change their password, especially if they use this password to access other sensitive online sites such as banks

"A file containing 6,458,020 SHA-1 unsalted password hashes has been posted on the internet, and hackers are working together to crack them," said Graham Cluley, security consultant at Sophos.

"Although the data which has been released so far does not include associated email addresses, it is reasonable to assume that such information may be in the hands of the criminals," he added.

As usual, the advice to LinkedIn users is to change their password. To do this, click the drop-down menu under your name in the top right corner of the site, select Settings and then Account.

"It's important for LinkedIn users to change their password, especially if they use this password to access other sensitive online sites such as banks," said Andy Dancer, CTO of Trend Micro.

He advised against using the same passwords across multiple sites, but admitted that "given the amount of websites people access every day it is becoming increasingly difficult to memorise unique passwords for each site".