Last.fm Data Breach

What happened

In March 2012, the music website Last.fm was hacked and 43 million user accounts were exposed. Whilst Last.fm knew of an incident back in 2012, the scale of the hack was not known until the data was released publicly in September 2016. The breach included 37 million unique email addresses, usernames and passwords stored as unsalted MD5 hashes.

Exposed data

Recommended actions

• Change your Last.fm password immediately, and update it anywhere you reused the same password.
• Enable two-factor authentication on the affected account and on your critical services (email, banking).
• Watch for targeted phishing emails referencing Last.fm — attackers weaponise breach data quickly.
• Check whether your email address appears in this breach on haveibeenpwned.com.