Stolen data obtained from music site Last.fm back in 2012 has surfaced, and it looks like hackers made off with accounts belonging to more than 43 million users.
That's according to LeakedSource, a repository for data breaches that obtained a copy of the stolen data. Included in the trove are users' names, email addresses and passwords secured with an aging hashing algorithm called MD5, LeakedSource reported in a blog post on Thursday.
Last.fm hasn’t responded so far to a request for comment. The music service reported the breach four years ago and asked all its users to change their passwords immediately. It never made clear how many accounts were affected, however, or the hashing method it used to secure the passwords.
LeakedSource said it obtained the stolen data from someone with the Jabber ID firstname.lastname@example.org. Hackers have been regularly supplying the repository site with data taken from past breaches, partly to draw publicity to themselves.
A sample of the stolen data was provided and the information appears to be legitimate. LeakedSource said it took only two hours to crack more than 96 percent of the passwords from the database.
About 9 million of the accounts were registered with email addresses at hotmail.com, while another 8 million were at gmail.com.
Last.fm has been waning in popularity over the years. It’s currently the 1,765th most visited site in the world, down from 779th when the breach was detected in 2012, according to web traffic monitor Alexa.
Still, hackers could have relied on the stolen data to attack other internet accounts, such as for affected users who reused their Last.fm passwords to register with other sites.
News of the Last.fm breach comes as stolen data on 68 million Dropbox accounts has begun circulating more widely on the internet.
Anonymous hackers likely obtained that data also in 2012, meaning they had four years to exploit the stolen information before it became public. Security experts are urging affected users to change their passwords across all their internet accounts and to use two-factor authentication to secure them.