MySpace Data Breach (2008)

The first anyone outside the company heard of the MySpace breach was a Motherboard report dated 27 May 2016: a seller using the alias Peace claimed to hold 360 million MySpace email addresses and passwords. Motherboard gave a data trading site the addresses of five people it knew and got the right password back for all five. MySpace did not answer requests for comment. Peace then listed the set on a criminal marketplace for six bitcoin, a few thousand dollars at 2016 prices.

Troy Hunt loaded all 359,420,698 unique addresses into Have I Been Pwned and published his dating analysis on 31 May 2016. With no timestamps in the dump he worked from the email providers: Yahoo addresses outnumbered Gmail five to one, which fits a userbase signed up before Gmail went mainstream. Readers who had kept their MySpace welcome emails were in the data; one who joined in December 2009 was not. His estimate was that MySpace was hacked sometime between mid-2008 and early 2009, and the exact date is unknown to this day.

MySpace’s one statement, noted in Troy Hunt’s update, dated the data to before a platform change on 11 June 2013 and said nothing about how long before.

The MySpace data breach left three fields per account: the email address, the MySpace username, and a SHA-1 hash of the password, with a second, older hash on about 68 million accounts according to Motherboard. Nothing else was in the set: no real name, no date of birth, no phone number.

Three fields is still worse than it sounds. Usernames are the handles people carried to other services, and the email address is the login on most of them, so each row is a ready-made pair to try elsewhere.

MySpace stored SHA-1 hashes, unsalted, of only the first 10 characters of each password after lowercasing them. Together those three choices left the set close to readable.

SHA-1 was built for speed, so one modern card tries billions of guesses a second. Without a salt, identical passwords give identical hashes: crack “password1” once and every account using it falls with it. Truncation is the unusual part. A sixteen-character password with capitals and symbols became its first ten characters in lowercase before hashing, so the MySpace breach weakens even good passwords. Motherboard reported that the site holding the data expected to crack 98 or 99 percent of the hashes within a month. Assume yours was among them.

Start with the password. If any account still uses the MySpace password, or a longer one that begins with the same ten characters, change it there first: the hash covers that opening stretch whatever came after. Then the username. If your MySpace handle is your handle elsewhere, treat those accounts as linked to this email address and give each its own password and two-factor sign-in.

Phishing that mentions MySpace by name is unlikely after ten years; other breaches holding this address are not. Run the free LeakNix check to see which ones, and whether any exposed a password you still use.