{"id":50225,"date":"2016-06-03T11:54:52","date_gmt":"2016-06-03T18:54:52","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=50225"},"modified":"2025-08-31T22:25:45","modified_gmt":"2025-09-01T05:25:45","slug":"myspace-accounts-hacked","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/myspace-accounts-hacked\/","title":{"rendered":"Cybercriminals Crack into 360 Million Old Myspace Accounts"},"content":{"rendered":"

It\u2019s easy to create online accounts, and it\u2019s just as easy to forget them. Remember Myspace? The early social media network existed before Facebook, but even those who spent a lot of time on it may have forgotten all about it. That\u2019s why a recent breach on Myspace<\/a> that exposed 360 million people\u2019s accounts is a serious blast to the past.<\/p>\n

Time Inc., the owner of Myspace, confirmed in late May that a cybercriminal is attempting to sell 427 million passwords<\/a> stolen from the early social network\u2019s database. The breach, the company said, affects as many as 360 million users, and may very well be the biggest breach in history so far. The seller, who goes by the alias \u201cPeace,\u201d is fielding the stolen goods for $2,800.<\/p>\n

Now, this breach does offer us some insights into the long-term impacts our digital footprints can have. For example, many people hadn\u2019t thought about, or visited, Myspace in years. Nevertheless, user emails and passwords were maintained on the network\u2019s servers, which were compromised. The same can go for any service. When you stop and consider all of the old, defunct or forgotten services you\u2019ve registered for, it adds up to a lot of potential security issues.<\/p>\n

When we create, and then neglect, online accounts, outdated security can create opportunities for cybercriminals. For example, Myspace\u2019s legal department told users via email, \u201cdata stolen included user login data from a portion of accounts that were created prior to June 11, 2013 on the old Myspace platform.\u201d \u00a0What this means is that in June 2013, Myspace launched new security protocols, but it did not update them for accounts created before the 11th. Instead, they were stored<\/a> with the older, less secure SHA-1 function<\/a>.<\/p>\n

To better explain, let me give you a quick run-through of basic cryptology. If companies store passwords in the same format as the users type them, breaches can become more dangerous. For example, cybercriminals could simply copy and paste passwords if they ever gained access to the data. That\u2019s why companies use encryption to hash<\/a> passwords. This means passwords are mixed up before being stored on a server. If someone breaks into the database, they then have to crack the jumbled code to obtain the real passwords. But hashing isn\u2019t enough to protect passwords. So, companies began salting<\/a>, or adding random data to passwords before hashing them. This combination of salting and hashing makes it difficult for criminals to both reverse-engineer the key code and discern genuine data from false data.<\/p>\n

Let\u2019s take this knowledge back to the context of the Myspace hack. While the company salted and hashed passwords after 2013, prior accounts were stored in an unsalted format<\/a>. Those were the breached ones, and ultimately, the outdated SHA-1 function exposed Myspace users. The lesson here is that our forgotten, old accounts are not only subject to increased vulnerabilities, but they also create easier opportunities for cybercriminals to hack away.<\/p>\n

At the end of the day, users can also be more responsible for their old internet profiles given increased risks over time. It\u2019s too easy, and dangerous, to forget the digital trails we leave behind. Being aware of online accounts coming and going allows us to better protect ourselves from those exploiting accounts of our past.<\/p>\n

How to Protect Your Online Life<\/h2>\n

With that in mind, here are some basic steps you can take to protect all stages of your online life:<\/p>\n