LinkedIn data breach: the 2012 leak and its 2016 resurfacing
2 min read · Updated October 15, 2026
In 2012 attackers stole LinkedIn credentials, and about 6.5 million hashed passwords were posted publicly. In 2016 a much larger dataset of roughly 117 million email and password pairs appeared for sale. If you used LinkedIn then and reused the password elsewhere, change it and enable two-factor authentication.
What happened
A set of hashed passwords from LinkedIn was posted online in June 2012. Four years later, in 2016, a far larger collection tied to the same 2012 incident surfaced, containing email addresses and password hashes for a very large number of accounts.
What was exposed
- ✓Email addresses.
- ✓Password hashes, which were weakly protected and many were cracked.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
Why it matters to professionals
LinkedIn is tied to your work identity. Exposed addresses fuel targeted phishing that mentions jobs, recruiters or colleagues. If a password was reused for email, attackers could gain a far more valuable account.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Did LinkedIn force resets?+
The company took steps to invalidate affected passwords after the data appeared. Do not rely on that if you reused the password elsewhere.
Should I worry if my password was strong?+
A strong, unique password is much safer, but if you reused it, change it.
How can I check for exposure?+
Run a breach check on the email you used for LinkedIn.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.