What happened?
In 2023, LinkedIn was hit by a massive data breach that exposed data from about 19.7 million users. The data, collected through scraping techniques, included personal information such as names, email addresses, locations, positions, and skills. This incident led to the sharing and selling of this information on hacking forums.
How did it happen?
The attack was not a direct hack of LinkedIn's systems, but occurred via "scraping," a technique in which automated tools collected public data from profiles. While scraping is not in itself a hack, it poses a significant privacy risk because the data collected can be combined with other sources for cyber attacks such as phishing and brute-force attacks.
What was the impact for the company?
The leaked data was used for large-scale phishing campaigns and social engineering, with attackers posing as trusted contacts. This led to reputational damage for LinkedIn, especially since many users were unaware of the scraping activities. In addition, sensitive data, such as email addresses, were used by cybercriminals for further attacks, leading to heightened data security concerns on the platform.
How could this have been prevented?
While scraping is not directly a hack, LinkedIn could have taken stricter measures to block automated scraping. In addition, using strong security practices such as multi-factor authentication (MFA) and better privacy settings could have protected users from further misuse of their data.
If your company needs advice on how to better secure your employees and systems from such threats, Cyberplan can help you with personalized solutions.