Data from years past strikes again. This time, data from 2012 of users of the music site Last.fm was found posted on the pwned repository LeakedSource, according to the indexing website Softpedia. In 2012, Last.fm advised its customers to reset their passwords, but did not provide more details. At that time, over a million passwords from users were published on a cryptography forum and resulted in users receiving a bunch of spam.
The new batch of data includes usernames, passwords, email addresses, dates the customers joined, and other “internal data” of 43.6 million users. Unfortunately, the passwords, though encrypted, were not well-encrypted and it took LeakedSource only two hours to decipher them into a readable format.
Users of the music site should of course expect more spam and inside the spam is likely to contain phishing lures. If there are unexpected links or attachments in the email, be wary and don’t click them unless you are 100% certain they are safe. Phishing email can come from strangers or appear to be from people you know, including business associates. So, don’t assume that if you recognize the sender’s name, the message is safe.
In addition, change your password again, especially if you haven’t changed it in a while. Make a habit of regularly changing passwords for all online sites. If possible, do this quarterly, but at least annually or when notified of a breach of the related site. Don’t forget to use strong passwords and use a unique one for each site. Password reuse has been blamed for several breaches including Twitter and LinkedIn, and was blamed for the infamous “naked celebrity” incident of a couple of years ago.
Last.fm joins a long list of popular sites that have recently had stolen information posted for sale on the Dark Web. Others of late include MySpace, LinkedIn, Dropbox, Fling, and Ashley Madison.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
