Hackers Make MySpace Pages Their Space by Stealing Passwords and Email Addresses

It isn’t news to find out that email addresses and user names and passwords have been leaked and are for sale on the Internet underworld. In fact, not long ago, over 164 million of them were found belonging to LinkedIn users. Now, there is word that between 360-427 million from MySpace have been seen for sale.

It is thought that the breach is old and just unreported. However, it means that anyone using that site and all of those who ever did create an account on MySpace should change passwords; especially if it’s one used on another site. This brings up the point that reusing passwords across multiple sites is not recommended. This practice catches out many users, including some unfortunate celebrities in the “naked celebrity” incident, Neiman Marcus shoppers from earlier this year, as well as Spotify music lovers and taxpayers who use TaxAct. Found in the data were passwords for over 360 million accounts and email addresses for over 427 million.

When choosing passwords, they should be “strong.” This means include all of the following:

• At least eight (8) characters,
• A combination of lower and upper case letters,
• At least one number, AND
• One special character, which are essentially those characters above the numbers on a typical keyboard

Strong passwords should not consist of:

• Words found in dictionaries,
• Sequential numbers;
• Easy to guess or common passwords such as “qwerty1,”
• Birthdates, social security numbers, children’s names,
• Any other personally identifying information

Even those who have changed passwords recently should change them again for MySpace accounts. This is because it isn’t known when the breach occurred that resulted in the hacker’s access. It may have been a while ago, as is being reported, but it may also have been recently. Just err on the side of caution and change them again.

There is a list of the top 10 passwords used on MySpace. While some of them do include the special characters and combinations of letters and numbers, they are generally thought to be insecure passwords for various other reasons, such as sequential numbers and letters. These are good examples of what not to use as your passwords for any account:

1. homelesspa
2. password1
3. abc123
4. 123456
5. myspace1
6. 123456a
7. 123456789
8. a123456
9. 123abc
10. (POSSIBLY INVALID)

Since the email addresses were stolen from a site that has a lot of personal details, spear-phishing is a possibility as well, so use caution clicking links or opening any attachments, particularly if they were unsolicited or unexpected.

If you are no longer using MySpace or other online accounts, go in and delete your account. If that isn’t possible, delete any identifying information or change it to something fake. This will keep your online footprint a little smaller and therefore lower your risk of being a victim of a breach like this one.