43 Million Passwords Hacked in Last.fm Breach

Thanks @Jason Tate

I didn't see that this had happened. Changed my password immediately.

 

Damn this crazy, kudos for linking to LeakedSource, just found out about a few of my other accounts on other websites that were leaked.

 

Yeah good source. My email is safe but my old school email address got two hits from 2012-2013 huh

 

It's crazy, really. Systems have always lagged behind in password security practices even though the technology has always been there.

 

Will be keeping LeakedSource bookmarked. Really useful.

 

More important than changing your password on last.fm, is to change your password anywhere else you suspect you may have used the password that was leaked. Your last.fm username and email can be used to find accounts you have on other services, and if you had used the same password, those accounts will be compromised as well.

 

MD5 is not to be used for password hashing, unbelievable.

 

Thanks for posting this. Also didn't know about Leaked Source so glad I checked that out. Had 7 things pop up and changed a few of those already. Good thing my Last.fm password was unique to most of my other stuff....

 

My MySpace, Tumblr, Dropbox and Last.FM all on there. Yikes.

 

I change email addresses, usernames and passwords so frequently that I shouldn't have been as surprised as I was when nothing showed up for me on LeakedSource.

Edit: also the most used password was 123456? Seriously? I thought last.fm users would be tech savvy enough to know better.

 

Thanks for that link which lets you check to see if your email address was hacked @Jason Tate -- found out 2 of my emails have been hacked on numerous sites.

More importantly...last.fm has 43 million users???

 

Yeah, unfortunately I got hit by this =/

 

This.

 

I remember that you posted a link to LeakedSource before but I forgot where it was. It is a great resource and I'm glad you are sharing it! Luckily, I was safe in this instance but it never hurts to check!

 

Surprisingly my two current emails didn't show up with anything. My old email pinged from 3 years ago with Last.fm and Neopets lmao. That email was abandoned long ago tho and nothing important is associated with it, that I know of at least and back then password requirements were so weak that I don't think I use many of the same ones. Either way I'm locked out of that email so oop

 

Thank you for the LeakedSource link! Just checked my most active email accounts and got a few hits from way back 2012-13. I have changed since, but I guess I should change again just as a precaution.

And weird that my email address was in Ashley Madison database. Like, wtf.

 

I didn't really think last.fm was still a thing

 

great resource, I apparently had my last.fm hacked in 2012 which sounds accurate as the last time I used it hah. Myspace, and tumblr and neopets (ayyy @Kiana lmao) as well. Whoops

 

I had an ancient password on here, definitely going to change it, thanks

 

Have I been pwned? Check if your email has been compromised in a data breach Is a good resource as well.

 

This should serve as yet another reminder of why you should use randomized passwords and a password manager. Otherwise, someone who compromises one of your accounts can get them all.

I personally use KeePass (free) and keep the encrypted file in my OneDrive. Got apps for all my devices. My encryption password is 20+ characters long, so brute forcing it would take forever even if someone were to get access to the file itself.

While LastPass/Dashlane are fine, I like the additional security of requiring people to compromise both my OneDrive and then have to figure out how to hack my KeePass file. If you're going to use a cloud service, make sure to at least set up some kind of two-factor authentication with it.