Data breach
Last.fm data breach
In 2012, Last.fm suffered a data breach affecting 43,367,415 records. Exposed data included account information, usernames, passwords and 1 other type of data.
Breach date
43.4 million
Records in the breach
4
Types of data exposed
Were you affected by the Last.fm breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the Last.fm breach
- Account Information
- Usernames
- Passwords
- Email Addresses
About the breach
The Last.fm Data Breach occurred in March 2012 when the music streaming platform was hacked, exposing more than 43 million user accounts.
Key Details of the Breach
• Date of Incident: March 22, 2012
• Public Disclosure / Leak: Although Last.fm knew of an issue in 2012 and urged users to reset passwords, the full scale and contents of the database weren't publicly leaked or widely decrypted until September 2016.
• Compromised Data: Approximately 43 million accounts (including around 37 million unique email addresses), usernames, and passwords.
• Vulnerability: Passwords were stored using unsalted MD5 hashes (a weak and outdated hashing method), allowing third parties like LeakedSource to crack a vast majority of the stolen passwords quickly.
Key Details of the Breach
• Date of Incident: March 22, 2012
• Public Disclosure / Leak: Although Last.fm knew of an issue in 2012 and urged users to reset passwords, the full scale and contents of the database weren't publicly leaked or widely decrypted until September 2016.
• Compromised Data: Approximately 43 million accounts (including around 37 million unique email addresses), usernames, and passwords.
• Vulnerability: Passwords were stored using unsalted MD5 hashes (a weak and outdated hashing method), allowing third parties like LeakedSource to crack a vast majority of the stolen passwords quickly.
How to protect yourself
In order to start protecting yourself from possible fraud in future, we highly recommend the following steps:
1. Immediately change your password on the affected website, but also any other website where you may re-use this password.
2. Download the Google or Microsoft Authenticator App on your mobile device. Activate 2FA authentication on any website you use, which allow for it.
3. Consider call identification apps on your mobile device, such as True Caller, which could assist in identifying possible scam calls.
1. Immediately change your password on the affected website, but also any other website where you may re-use this password.
2. Download the Google or Microsoft Authenticator App on your mobile device. Activate 2FA authentication on any website you use, which allow for it.
3. Consider call identification apps on your mobile device, such as True Caller, which could assist in identifying possible scam calls.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.