Feeds

LinkedIn faces class action suit over password leak

People can take data from us, but not money

5 things you didn’t know about cloud backup

LinkedIn is facing a class action suit over the security breach that saw millions of users' passwords posted online.

Illinois resident Katie Szpyrka leads the complaint, which alleges that LinkedIn failed to "properly safeguard its users' personally identifiable information".

The complaint filed in California accuses the business network of using a "weak encryption format" for users' information and not having crucial security measures in place.

A LinkedIn spokesperson told The Register that the class action suit's claims were "without merit".

"No member account has been breached as a result of the incident, and we have no reason to believe that any LinkedIn member has been injured," the company said. "Therefore, it appears that these threats are driven by lawyers looking to take advantage of the situation.

"We believe these claims are without merit, and we will defend the company vigorously against suits trying to leverage third-party criminal behaviour."

The 6.5 million user passwords hacked and posted online were in hashed format, but the biz site evidently had not applied any salts. Salting adds extra arbitrary data to a password when it is hashed, thwarting pre-generated tables and making life more difficult for password crackers. The class action suit claims that hashing without salting is not an "industry standard protocol" as promised by LinkedIn's privacy policy.

"Despite its contractual obligation to use best practices in storing user data, LinkedIn failed to utilise basic industry standard encryption methods. In particular, LinkedIn failed to adequately protect user data because it stored passwords in unsalted SHA1 hashed format," the filing said, branding SHA1 "outdated".

The case also latches on to reports that LinkedIn was hacked through an SQL injection attack, which uses weaknesses in a company's website to get into its back-end systems.

"If true, LinkedIn's failure to adequately protect its website against SQL injection attacks - in conjunction with improperly securing its users' personally identifiable information - would demonstrate that the company employed a troubling lack of security measures," the complaint said.

Naturally, the class action suit is looking for attorney fees and damages for US members of LinkedIn. ®

5 things you didn’t know about cloud backup

More from The Register

next story
Has Europe cut the UK adrift on data protection?
EU reckons we've one foot out the door anyway
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
Just TWO climate committee MPs contradict IPCC: The two with SCIENCE degrees
'Greenhouse effect is real, but as for the rest of it ...'
'Blow it up': Plods pop round for chat with Commonwealth Games tweeter
You'd better not be talking about the council's housing plans
Arrr: Freetard-bothering Digital Economy Act tied up, thrown in the hold
Ministry of Fun confirms: Yes, we're busy doing nothing
CIA super-spy so sorry spies spied on Senate's torture scrutiny PCs
That thing we swore blind we never did? About that…
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?