Preface

MySpace.com was hacked on June 11th, 2013. LeakedSource has obtained and added a copy of this data to its ever-growing searchable repository of leaked data. This database was provided to us by a user who goes by the alias “Tessa88@exploit.im”, and has given us permission to name them in this blog. MySpace has not returned our request for comment on this matter, nor have they replied to a similar request from a reporter.

LeakedSource is a search-engine capable of searching over 1.6 billion leaked records — an aggregation of data from hundreds of disparate sources. We have been able to accumulate this data over a relatively short period of time through a combination of deep-web scavenging and rumor-chasing. Occasionally these efforts lead to major discoveries (e.g. MySpace, LinkedIn), but we really aren’t too picky. If we come across a leaked database from a company that most people haven’t heard of, we will incorporate it into our master database just the same.

You may search for yourself in the leaked MySpace.com database by visiting our homepage. If your personal information appears in our copy of the MySpace database, or in any other leaked database that we possess, you may contact us and request to have it removed free of charge.

Since embarking on this ambitious project just a handful of months ago, we have processed an unbelievable amount of data. Much more than we expected, more than most large companies will ever house — and we’re just getting started. LeakedSource may soon become synonymous with Big Data, so don’t miss out!

Anyone may use the information on this page for free in any capacity provided LeakedSource is given credit and a link back.

LeakedSource does not engage in, encourage or condone unlawful entry (“hacking”) into private systems.

Table of Contents

• Preface
• Summary
• API
• Passwords
• Emails

Summary

This data set contains 360,213,024 records. Each record may contain an email address, a username, one password and in some cases a second password. Of the 360 million, 111,341,258 accounts had a username attached to it and 68,493,651 had a secondary password (some did not have a primary password, total is below).

API

After the last breach we received many requests for API access, and we are launching a business API with a consumer one to follow in the near future. You can read about the API features at our API page

Passwords

Passwords were stored in SHA1 with no salting. “Salting” makes decrypting passwords exponentially harder when dealing with large numbers of passwords such as these. The methods MySpace used for storing passwords are not what internet standards propose and is very weak encryption or some would say it’s not encryption at all but it gets worse. We noticed that very few passwords were over 10 characters in length (in the thousands) and nearly none contained an upper case character which makes it much easier for people to decrypt.

Due to some accounts having two passwords, there are 427,484,128 total passwords for only 360 million users. Additionally, the accounts with password “homelesspa” seem to be automatically generated as all the emails that use this password follow the same format. We also suspect given the number of passwords with a 1 at the end, MySpace required numbers and letters at some point.

Until MySpace responds to our attempts to contact them, we are going to display only the first few characters of plaintext passwords if available so users can verify which password of theirs was leaked.

The following table shows the top passwords used by MySpace users.

Emails

Simple table of top email domains