A collection containing data on more than 700 million users was leaked last week after hackers attempted to sell it earlier this year.
The collection is currently being shared on private Telegram channels in the form of a torrent file containing approximately 187 GB of archived data.
What is data scraping?
Data scraping, also known as web scraping, is a technique that exploits the code powering websites like Facebook and LinkedIn by using it to scan hundreds of millions of profiles, collecting information such as a user’s name, ID, profile URL, location, and email address, regardless of whether a user sets their privacy settings to hide information from the public or not.
Scraping differs from an actual data breach because a breach means that security features, such as password access, have been bypassed.
In general, the last two years have seen a significant increase in cybercrime in terms of the scale, sophistication, and severity of threats. The US Federal Bureau of Investigation, in its annual Internet Crime Report, described how it collected 791,790 complaints of alleged online crimes in 2020, amounting to $4.2 billion in losses in the US alone.
The FBI received 467,361 complaints in 2019.
Why is this latest leak so dangerous?
What makes this latest leak dangerous is that it contains email addresses that are not normally visible to the public on the official LinkedIn site. Linked to users’ real names, the email addresses and the leak are a goldmine for cybercriminals looking to target high-profile executives or employees working in sensitive areas of a company, such as finance departments or security teams.
While the average social media user might not see the value in a database extracted from publicly available information that users shared voluntarily, a hacker looking to coordinate scams and phishing attacks could easily collect various datasets from leaks like those originating from LinkedIn and Facebook to build an accurate and informed understanding of that person’s identity.
For example, a fraudster looking to target or impersonate an employee with access to sensitive company information or even bank accounts could gather information from different databases on the same set of targets, enabling them to write convincing emails impersonating others or, in general, direct behavior toward the hacker’s goals.
What can (and should) I do to protect myself?
- Change your LinkedIn password
- If you are using this same password elsewhere, change it there as well
- Close all active LinkedIn sessions (on your mobile, home computer…)
- If you want to stay protected and alert to all leaks that may occur and thus avoid threats to your personal or professional life, we recommend hiring our DATA LEAK FINDER service, the best solution for anticipating problems derived from a data leak.
Sources: The Record Media, The Shift News
