The same threat actor has leaked larger amounts of data from LinkedIn dated 2023. They claim this new data contains 35M lines and is 12 GB uncompressed.
The jokes on LinkedIn. T-Mobile already has my social security number, birth date, and other important information on the dark web, thanks to their security breach.
Don’t forget Equifax, assuming you are in the USA
Don’t forget the OPM hack in 2014, also assuming you’re in the USA and received a military/government background check.
Don’t forget Equifax, assuming you are in the USA
I mentioned T-Mobile because I had gotten notification from AAA/ProtectMyID service that I was signed up for free after one of their breaches, that my information from the T-Mobile incident what was on the dark web. The scan service specifically mentioned T-Mobile.
But yeah you’re right, I knew also that Equifax had problems as well.
Strangely enough, that data doesn’t seem to have surfaced anywhere. There’s a decent chance it was stolen by a nation-state actor using it for espionage.
Gadammit, my linkedin uses my clean email account. Linkedin security, do better!
Was surprised at first, then I went to go log in to change my password.
And then it said I was emailed a 2FA code… the code was part of the email header.
Now I’m completely unsurprised this happened.
the code was part of the
… part of the Subject header in the encrypted body of the message, you mean? What a nothing-burger.
encrypted body of the message
Encrypted what? LinkedIn lets you add a key/cert to send you encrypted emails?
I’m not sure what you’re implying here regarding headers? Email is insecure regardless; even when using SMTP with TLS, it’s not like the headers are exposed whereas the body would be encrypted or something.
deleted by creator
well with PGP, the header is unencrypted
Is there a single large company that even sends PGP email?
logging into example.com with the user’s email and that 2fa code is going to be a breeze
Sure, IF 1. you already have the user’s password, and 2. a new code wouldn’t be required/the previous code invalidated when initiating a new login session?
Like, I’m not saying that 2FA codes via email is secure, but you’re implying that they are making a security hole via this - which I don’t see.
Pgp, the greatest program never used by anyone
I used it. For about 10 minutes. Then I read the help files. Then I searched. Then I used it some more. Then I uninstalled it.
Unless you followed by installing gpg… then you failed. There are tons of uses for it, not necessarily encrypting emails (or more precisely, it kind of sucks at encrypting emails).
Yeah not following the logic. 2FA via email is insecure. Doesn’t matter where in the email. That person is confused about something.
deleted by creator
I’m excited for my class action award of $3
deleted by creator
deleted by creator
Can someone check if my password is there? It’s ‘dupa.7’. Thanks.
dupa.7
https://haveibeenpwned.com/Passwords confirms that is has been hacked 11 times.
Ok, changed to ‘dupa.8’. Thanks.
This password has been seen 2,265 times before
s e c u r i t y
Or the most secure one: hunter2
What’s that? All I see is *******
I see Lemmy has implemented Reddit’s security settings. Impressive.
RedditIRC ftfy
Well, fuck. This was the ONE social media site that I put my data on, and that was out of necessity (job hunting). I know it’s not the same, but this sort of feels like the Equifax breach.
It’s not an actual leak. It’s mostly scraped data and fake addresses.
deleted by creator
It’s so stupid, but definitely can be helpful professionally to maintain a profile there. Depends on your experience and what field you’re in, of course, but recruiters seem to use it a fair amount.
Definitely don’t use it for the garbage social media aspect (it’s like some weird crowd-sourced Chicken Soup for the Soul shit??) However, I’ve been convinced of its utility after getting a new job through a recruiter there without even looking. The process was sooo easy compared to applying for jobs the traditional way. Icing on the cake was that it came with a 50% raise and was for a position I would never have applied for on my own but I love it. Maybe it was lightning in a bottle, but I figure doesn’t hurt to keep up a page just in case another good opportunity comes along. If nothing else, the recruiters I hear from give me a sense of how hot the market is and what kind of jobs my profile is pinging me for in case I want to make tweaks.
deleted by creator
Oh god yeah, I feel that. I’d have a harder time keeping mine up if my colleagues were actually attempting to engage with me on it haha.
It still works as intended if you ignore all that and keep your head down. I get a fair amount of relevant offers and I got rather nice jobs through it over the last 15 years.
And everyone is a *manager or “executive of”. Even a McDonalds burger flipper is “executive in charge of protein rotation”
Its all HR people constantly job hunting by sharing the equivalent of those “hang in there” wall posters from the 90s and adding a paragraph about what it takes to make it in the workforce.
Ill make one of these bullshit posts now.
Suggested:
In school my old teacher Mr. Gerry would perform the elephant toothpaste experiment. This got me thinking. The glass beaker is like the job market and the chemicals mixed together is like your marketable skills that grow to fill the needs of the job market. In my 16 years as a human asset coordinator I’ve come across many difficulties that required shifts in how I approached the job market. Be like the elephants toothpaste and explode into the market beeeeyaaaaa
If it’s any consolation, LinkedIn is notoriously terrible at this, so your data was probably out there as early as 2016 and almost certainly after 2021, when they managed to get hit with similar breaches twice in the same year.
deleted by creator
And we share real background information, very specific details. This could lead them to our friends and colleagues!
But I’m not sure it can be called social media, though, but if you are looking for social media platforms that can avoids data leaks, and don’t ask for your personal info when register, WireMin and Damus are both good choices.
Speaking of which, we should have a version of LinkedIn that is decentralized!
linked in that is decentralized
Now you shut your damn mouth, let’s just let Linked In die like it was always supposed to. It’s not some sort of positive networking platform, it’s just a platform that reinforces the old boys club, with some cringey posts from people who are trying to hard.
deleted by creator
deleted by creator
That would explain the targeted scams I’ve been subjected to which seem to have been coming from old colleagues
Now I know why I’m getting scam mails on the email address that I never use online and scam phonecalls on the phone number I never use online, except for LinkedIn.
Great timing, started using linkedin like 2 weeks ago😅
Why? Are colleges still promoting it or something? LinkedIn use can be almost damaging to success. I know when we receive a packet that enthusiastically references their LinkedIn, we just roll our eyes. And in my personal experience, people who spend a lot of time on LinkedIn, just spend a lot of time on social media… which would get you in big trouble where I work. Yet people still do it and get caught.
We pretty much avoid LinkedIn like the plague. People over share and then all the sudden the committee has info in front of their eyeballs about a candidate that should never have been part of their info.
I barely do anything with it, but most people here have one, it’s quite normal
No, that’s good… have one, just barely ever use it.
According to Troy Hunt this alleged leak is mostly from older leaks and fake data:
“this data is a combination of information sourced from public LinkedIn profiles, fabricated emails address and in part (anecdotally based on simply eyeballing the data this is a small part), the other sources in the column headings above. But the people are real, the companies are real, the domains are real and in many cases, the email addresses themselves are real”
Source: https://www.troyhunt.com/hackers-scrapers-fakers-whats-really-inside-the-latest-linkedin-dataset/
So glad that I did NOT simply close my account there, but instead I changed every single piece of personal data to some meaningless xyz123 before I finally closed it.
Your old info is still backed up there
Yes, but it was a while ago, and the backup gets older every day.
Again and again and again and again. I get more spam on my linkedin email address than I do on any other.
I have a set it up so that any email sent to unknown users on my domain gets redirected to email. If you send an email to
bad_address@example.comand my real email isuranibaba@example.com, I will still receive the email.Now this is great because I will just use
name_of_service@example.comand still get the email. If the email is leaked, I will know where it came from.Be careful, my domain got on a whole bunch of ISP’s spam lists because I had done the same thing.
They really don’t like open domain email working.
That’s annoying! It’s not been my experience, out of curiosity do you have any theories why your domain/aliases got blocked?
out of curiosity do you have any theories why your domain/aliases got blocked?
For my domain it was put on a spam list that various ISPs use.
When I spoke with one ISP they said it’s because I had an open email address situation going, where a spammer can send a spam email out to a third party and on the reply address to they can make up anything as an email address for my domain name and it would be ‘valid’ because my domain email server was set up to receive all emails that you described.
And because of that I got put on a global spam list which many ISPs use. At the time I didn’t even know about my domain being on the list, I just noticed a big drop in emails I was receiving.
FYI this happened over a decade ago, so I do not know if that is the current practice today. But better to make sure any email addresses to your domain that is not valid does not go through. No “catch all” bucket situation.
That’s not because you have a wildcard. That’s because you need to implement DKIM, DMARC, and SPF records to prevent others from using your domain name to send mail.
MTAs use those standards to verify if somebody is permitted to send email for your domain. If you don’t have those set then you can get what that ISP described.
That’s because you need to implement DKIM, DMARC, and SPF records to prevent others from using your domain name to send mail.
Well I used a third party service to host my domain, and as far as I can remember (like I said this was over a decade ago, maybe almost two decades), everything was set up correctly at that time.
Not trying to dispute what you said, but I can at least speak towards that as far as we knew at the time we had the domain set up correctly on our end, the stuff we could control.
The only thing is we had a catch-all bucket setting turned on for emails to be forwarded to an internal email address of our domain.
There has never been a correct way to deploy these services, just increasingly complex, featurefull, and or secure ways to do it
Owning your own domain is great that way. Even makes the little bit I pay to ProtonMail well worth it. There are a few addresses I have dedicated, like my aws@example.com, me@, and my-name@, but the rest just go to a catch all. It’s fantastic.
My mail is hosted by my domain host but I am considering switching to Proton. Have you done such a move?
I made that move and had no issues. You can copy/paste your way through DNS setup and the rest is just configuring your proton account how you want.
You’ll want to be familiar with proton and some of the tradeoffs in its privacy model, but it’s most likely more feature-full than a hosting provider. Dreamhost, for one, is quite basic.
Yeah the setup is pretty trivial and it works great.
I ended up just disabling the alias I use to receive emails from LinkedIn. Since I noticed I just kept deleting those emails without ever reading them, I figured I’d just opt to not receive any emails. :D
It says it’s scraped and not leaked
That’s why today I got an email from a headhunter that used Data from my LinkedIn profile. Fuck this.
My sarcasm detector is uncertain with this one.
No sarcasm, I never got an E-Mail before from a Headhunter, only LinkedIn Messages. Not gonna lie, I hated it.
no because they probably paid a couple of hundred bucks to email you from one of the many data banks that source their information from LinkedIn.
Oh good. Just when I was looking for a job.
