With a pricetag of $2,200, the new haul came from a 2012 breach.
Login credentials for as many as 117 million LinkedIn accounts have been put up for sale online by someone who is seeking more than $2,200 for the haul, a security researcher said.

The credentials—which include e-mail addresses and passwords hashed using the woefully weak SHA1 function—appear to come from a 2012 breach of the career networking site, researcher Troy Hunt said in a series of tweets. LinkedIn officials have since verified that the 2012 hack was the source and said they are working to invalidate any passwords that may still be actively used on compromised accounts. According to LeakedSource, a site that maintains a database of more than 1.25 billion compromised accounts, the new batch contains data for 167 million accounts. 117 million of the records in the batch include a password field.
The discovery means that the 2012 LinkedIn breach was much bigger than previously believed. At the time, researchers found almost 6.5 million credentials belonging to site users. It's not clear if the new number of affected accounts is news to LinkedIn. In the days following discovery of the 2012 breach, company officials implemented a mandatory password reset for affected users. A statement from company officials on Wednesday saying that they're working to change any passwords still in use leaves open the possibility that they were unaware the number was so high.

According to posts on social media sites, the data was advertised on a dark Web site known as The Real Deal by someone with the user name peace_of_mind. It offers data for 167 million accounts for five bitcoins, which at current exchange rates is worth about $2,200.

In an e-mail, LinkedIn officials wrote:

In 2012, LinkedIn was the victim of an unauthorized access and disclosure of some members' passwords. At the time, our immediate response included a mandatory password reset for all accounts we believe were compromised as a result of the unauthorized disclosure. Additionally, we advised all members of LinkedIn to change their passwords as a matter of best practice.

Yesterday, we became aware of an additional set of data that had just been released that claims to be email and hashed password combinations of LinkedIn members from that same theft in 2012. We are taking immediate steps to invalidate the passwords of the accounts impacted, and we will contact those members to reset their passwords. We have no indication that this is a result of a new security breach.

We take the safety and security of our members' accounts seriously. For several years, we have hashed and salted every password in our database; and we have offered protection tools such as email challenges and dual factor authentication. We encourage our members to visit our
safety center to ensure they have two-step verification authentication and to use strong passwords in order to keep their accounts as safe as possible.

The LeakedSource post breaks down the most commonly used passwords and they reveal a stunning lack of care on the part of end users—and more to the point, on the part ofr LinkedIn for allowing them in the first place. The most widely used passcode was 123456, with 753,305 accounts. It was followed by linkedin with 172,523, password with 144,458, 123456789 with 94,314, 12345678 with 63,769, and 111111, with 57,210. Many sites are reluctant to forbid the use of such weak passwords out of a fear of alienating users. The leak underscores just how much a new approach is needed.