PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.

LinkedIn Sued Over Password Breach

 & Chloe Albanesius Executive Editor, News

Our team tests, rates, and reviews more than 1,500 products each year to help you make better buying decisions and get more from technology.

Our Expert
LOOK INSIDE PC LABS HOW WE TEST
65 EXPERTS
43 YEARS
41,500+ REVIEWS

The recent LinkedIn password breach has resulted in a lawsuit that accuses the enterprise social network of failing to properly secure its users' data.

"LinkedIn violated its own User Agreement and Privacy Policy by failing to utilize long-standing industry and standard protocols and technology to protect" its members, according to the lawsuit, which was filed in California district court by Illinois resident Katie Szpyrka.

Szpyrka is looking to attain class-action status.

Earlier this month, LinkedIn confirmed that hackers gained access to some of the enterprise social network's passwords. Approximately 6 million of LinkedIn's 161 million users were affected, and LinkedIn reset the accounts of those who were compromised.

LinkedIn utilized a "weak encryption format," the suit said, which "failed to comply with basic industry standards." That would be an unsalted SHA 1 hashed format, which the suit said is "outdated." Storing data without salting the password first "runs afoul of conventional data protection methods," the suit said.

In a statement, LinkedIn said it was aware of the class-action suit, but stressed that "no member account has been breached as a result of the incident, and we have no reason to believe that any LinkedIn member has been injured."

As a result, LinkedIn said it believes that the lawsuit is "driven by lawyers looking to take advantage of the situation. We believe these claims are without merit, and we will defend the company vigorously against suits trying to leverage third-party criminal behavior"

In a June 9 blog post, LinkedIn said one of its major initiatives has been to "transition from a password database system that hashed passwords, i.e. provided one layer of encoding, to a system that both hashed and salted the passwords, i.e. provided an extra layer of protection that is a widely recognized best practice within the industry."

LinkedIn said "that transition was completed prior to news of the password theft breaking."

Szpyrka joined LinkedIn in 2010 as a premium member and paid approximately $25 per month. The lawsuit did not specify if her information was accessed in the breach.

The suit was first reported by Courthouse News.

Editor's Note: This story was updated at noon Eastern with comment from LinkedIn.

About Our Expert

Chloe Albanesius

Chloe Albanesius

Executive Editor, News

My Experience

I started out covering tech policy in DC for The National Journal, where my beat included state-level tech news and all the congressional hearings and FCC meetings I could handle. I later covered Wall Street trading tech before switching gears to consumer tech. I now lead PCMag's news coverage.

My Areas of Expertise

Getting my start in DC means I still have a soft spot for tech policy; Congressional hearings can sometimes be as entertaining as a Bravo reality show, for better or worse. But PCMag is all about the technology we use every day, as well as keeping an eye out for the trends that will shape the industry in the years ahead (or flop on arrival). I've covered the rise of social media, the iOS vs. Android wars, the cord-cutting revolution that's now left us with hefty streaming bills, and the effort to stuff artificial intelligence into every product you could imagine. This job has taken me to CES in Vegas (one too many times), IFA in Berlin, and MWC in Barcelona. I also drove a Tesla 1,000 miles out west as part of our Best Mobile Networks project. Of late, my focus is on our hard-working team of reporters at PCMag, guiding and editing their robust coverage.

Read full bio