Bad actor offers up for sale data from 600 million LinkedIn members scraped from the site

2 years ago 275

Cyber News reports that this is the 3rd clip successful 4 months that subordinate accusation has shown up connected a hacker forum.

A information acceptable including accusation from 600 cardinal LinkedIn users showed up for merchantability connected a hacker forum this week. That's the 3rd clip successful 4 months that scraped information from the networking tract has been offered up for sale, according to a study from Cyber News.

The information is each publically available, specified arsenic afloat names, email addresses, links to societal media accounts and different accusation from LinkedIn profiles.

SEE: Data scraped from 500 cardinal LinkedIn users recovered for merchantability online (TechRepublic)

Scraping information and collecting it successful 1 spot is not arsenic superior arsenic a information breach. A breach typically exposes backstage information that is protected by privateness protections and disclosure rules specified arsenic Social Security numbers and relationship information. However, credential stuffing is 1 of the astir communal cybersecurity attacks. As Scott Matteson explained successful an interrogation with a information expert:

"Credential stuffing is the weaponization of stolen credentials (usernames and passwords) against websites and mobile applications. Lists of credentials stolen from 1 website are tested against different websites' login pages to summation unauthorized entree to accounts, successful bid to perpetrate fraud."

In its 2021 State of Security Identity report, the steadfast Auth0 recovered that credential stuffing accounted for 16.5% of attempted log-in postulation connected its platform. This bad histrion enactment reached a highest successful March astatine much than 40% of traffic, arsenic Jonathan Greig reported for ZDNet.

Proofpoint precocious reported that a menace histrion linked to the Iranian authorities has been targeting researchers who specialize successful the Middle East with credential phishing attacks.

People affected by a information breach have immoderate ineligible recourse against the company that suffered the information breach, but the rules astir information scraping are not arsenic clear-cut. In 2016, LinkedIn sued hiQ Labs for scraping information from the networking site, arguing that this enactment was a usurpation of the Computer Fraud and Abuse Act. LinkedIn mislaid the lawsuit erstwhile the US Ninth Circuit Court of Appeals ruled that information that is publically disposable is not protected by the CFAA.

TechRepublic contacted LinkedIn for a remark connected the latest acceptable of scraped data. The institution did not respond.

In effect to different scraped dataset that showed up successful June, LinkedIn said that nary backstage information had been exposed. Scraping information violates the company's presumption of service. The institution besides said that "When anyone tries to instrumentality subordinate information and usage it for purposes LinkedIn and our members haven't agreed to, we enactment to halt them and clasp them accountable."

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays