HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsLowContained

LinkedIn Corporation

bd_a3117a7331b232fb · schema v1 · pii pii-v1

Severity

Low

Discovered

May 17, 2016

Filed

Jun 2, 2016

To disclose

16 days

Affected

Not disclosed

Confidence

64%

Full breach record for LinkedIn Corporation →

LinkedIn Corporation notified the California Attorney General that data stolen in a 2012 breach was being made available online. On May 17, 2016, LinkedIn became aware of the exposure. The compromised data included member email addresses, hashed passwords, and LinkedIn member IDs. LinkedIn invalidated passwords for affected accounts created prior to 2012 that had not been reset. The company engaged law enforcement and implemented security enhancements including salted password hashing and two-step verification options.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 17, 2016 → Notified May 25, 20168d ✓ CA 60-day OK16 days discovery → filing

Incident timeline

undetected · 1598 days

discovery → filing · 16 days

Jan 1, 2012

Begins

May 17, 2016

Discovered

Jun 2, 2016

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: LinkedIn Corporation
norm: linkedin

Name: LinkedIn Corporation
norm: linkedin
Industry: Technologyllm

Discovered: May 17, 2016
Breach occurred: Jan 1, 2012 – Dec 31, 2012
Undetected for: 1,598 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 25, 2016
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unknown
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Invalidated passwords of all LinkedIn accounts created prior to the 2012 breach that had not reset their passwords since that breach
Using automated tools to attempt to identify and block any suspicious activity that might occur on LinkedIn accounts
Actively engaging with law enforcement authorities
Changes made: Use salted hashes to store passwords
Offer members the option to use two-step verification
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: CA 60-day OK · 8d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 17, 2016
→ Notified: May 25, 2016
8d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 17, 2016 → Notified: May 25, 2016	8d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-62124
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 2, 2016
Raw hash: 922a1521b8be67095c09c59f5defdce52cc6fc2cb5e0ca6d00ca7a97cdb0bb2f

Reporting entityLinkedIn Corporation

Victim entityLinkedIn Corporation

Incidentdiscovered May 17, 2016

Stated responseInvalidated passwords of all LinkedIn accounts created prior to the 2012 breach that had not reset their passwords since that breach

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov