LinkedIn's 2012 breach exposed 6.5M passwords — the full 117M came out 4 years later

In June 2012, LinkedIn disclosed that hackers had stolen approximately 6.5 million user passwords. The company reset affected passwords and urged users to change their credentials. The breach was treated as a limited incident.

In May 2016, a hacker offered 117 million LinkedIn email-password combinations for sale on a dark web marketplace. The data was from the same 2012 breach, but the full scope had not been disclosed. LinkedIn confirmed that the data was authentic and that the 2012 breach had been far larger than initially reported.

The four-year gap between the breach and the full disclosure was widely criticized. LinkedIn (acquired by Microsoft in 2016) was accused of downplaying the breach to protect its reputation during its IPO period. The case illustrated how the incentive to minimize a breach's perceived scope can delay disclosure and compound the damage to user trust.