MySpace data breach: 359.4M accounts exposed
Severity: critical · Patch status: no-fix-needed · Since 2016-05-31
In approximately 2008, MySpace suffered a data breach that exposed almost 360 million accounts. In May 2016 the data was offered up for sale on the "Real Deal" dark market website and included email addresses, usernames and SHA1 hashes of the first 10 characters of the password converted to lowercase and stored without a salt. The exact breach date is unknown, but analysis of the data suggests it was 8 years before being made public. Exposed data: email addresses, passwords, usernames. The breach dates from Jul 1, 2008; Have I Been Pwned loaded it on May 31, 2016.
What to do
- If you had a MySpace account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
