Data breach indexing website LeakedSource has announced today that it received a data dump of 43,570,999 user records that were stolen in 2012 from music streaming service Last.fm.
London-based Last.fm admitted to the data breach in June 2012, when it also asked users to reset passwords.
According to timestamps in the data received by LeakedSource, the Last.fm data breach occurred on March 22, 2012, which is consistent with a GigaOM article from June 2012 that reported a similar timeline for the security breach.
Last.fm said it started to investigate the incident after multiple users complained of spam in May 2012, and after a batch of 1.5 million user passwords ended up on a cryptography forum.
While Last.fm never revealed technical details of how the breach took place, some weak security measures were surely into play.
LeakedSource says it took them two hours to crack 96 percent of all the passwords included in the Last.fm data. This was possible because passwords used an unsalted MD5 hashing system.
Back on June 7, 2012, on the day after Last.fm asked users to reset passwords, a former Last.fm developer named Russ Garrett admitted on Twitter that passwords were hashed using MD5, a hashing function considered weak even before 2012.
...
http://news.softpedia.com/news/data-of-43-million-users-stolen-during-2012-last-fm-data-breach-507830.shtmlWhen I checked on
Leaked Source, I found out that my e-mail and password were leaked then. It's a good thing I didn't subscribe and provide them credit card details. Anyway, it seems most people stopped using Last.fm after they shut down their radio service 2 years ago, and updated to a new beta version last year, but I still use it to chart my listens.