The sale of data was first reported Tuesday by cybersecurity news and research site CyberNews, which said an archive of user IDs, names, email addresses, phone numbers, gender, professional titles and links to other social media profiles was auctioned off. on the forum for a four-digit sum.
According to LinkedIn, the database for sale is “actually an aggregation of data from a number of sites and companies.” The data from LinkedIn users only includes information that people publicly listed in their profiles, the professional social media site owned by Microsoft (MSFT), said in a Thursday statement.
“This is not a LinkedIn breach, and no private member account data from LinkedIn was included in what we have been able to review,”
; the company said.
The news comes just days after a separate incident in which data scraped from more than 500 million Facebook users in 2019 – including phone numbers, birthdays, emails and other information – was published on a site used by hackers. While these types of data are less sensitive than e.g. Credit card information or social security numbers, information such as telephone numbers can still be used by bad actors, including for robocall fraud.
LinkedIn has more than 675 million members, according to its website, which means that about three-quarters of users’ information can be included in the database.
Social media companies have tools in place to prevent scrapers – LinkedIn on its terms provides details of “technical measures and defenses” against such abuse – but they do not always work.
The company said that “any misuse of our members’ data, such as scraping,” violates its Terms of Service, which prohibit third-party software, bots, browser extensions, or plug-ins that scrape data from the Site.
“When someone tries to take member data and use it for purposes LinkedIn and our members have not accepted, we work to stop them and hold them accountable,” LinkedIn said in its statement.
The company did not immediately respond to a request for comment on whether it would warn users if data was scraped and included in the database for sale.