> series: anatomy_of_a_breach —— part: 089 —— datasets: myspace_360M_linkedin_117M_tumblr_65M —— total: 542,000,000<span class="cursor-blink">_</span>_
In May 2016, a hacker operating under the alias 'Peace' (or 'peace_of_mind') listed three enormous credential datasets for sale on the dark web marketplace TheRealDeal: Myspace (360 million accounts with SHA-1 hashed passwords), the full LinkedIn dataset (117 million accounts — nearly 20 times the 6.5 million initially disclosed in 2012), and Tumblr (65 million accounts with salted SHA-1 hashes). Each dataset was priced at just a few Bitcoin — making half a billion credentials available to anyone with minimal cryptocurrency.
The datasets were not from new breaches — they were the delayed surfacing of breaches that had occurred years earlier (Myspace ~2013, LinkedIn 2012, Tumblr 2013). The pattern revealed a disturbing reality: breaches can remain undisclosed for years while stolen data circulates privately among criminals, only becoming public when someone decides to monetise them on the open market. For those years, affected users had no warning that their credentials were compromised — and no reason to change passwords that were being actively exploited.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallWhen 542 million credentials are available for purchase, the question is not whether your users' passwords have been compromised — it is how many times. The only control that remains effective when passwords are compromised at this scale is multi-factor authentication. Cyber Essentials Danzell makes MFA an auto-fail criterion because eight years of this series have proved it is the single most impactful defence against credential-based attacks.
Dark web monitoring through SOC in a Box alerts your organisation when employee credentials appear in breach databases — enabling forced password resets before the credentials are used. Our penetration testing includes credential-stuffing simulation to test whether your authentication systems would resist automated attacks using known-compromised passwords. And UK Cyber Defence provides incident response when credential compromise leads to account takeover.
<a href="/cyber-essentials">Cyber Essentials</a> mandates MFA. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors dark web breach databases. Our <a href="/penetration-testing">penetration testing</a> simulates credential-stuffing attacks.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call