Music Fans Targeted in the 33 Million Record Last.fm Breach

Last.fm is a UK-based music discovery platform that launched in 2002 and became one of the largest music social networks online. In March 2012, attackers breached the Last.fm database and extracted records for over 33 million users. The company acknowledged a security incident at the time, but the full scale was not confirmed until the data surfaced publicly in September 2016. The breach exposed email addresses, usernames, and passwords stored as unsalted MD5 hashes, a format that is widely considered crackable with modern tools.

Why Last.fm Breach Is Dangerous

Unsalted MD5 hashes are among the weakest forms of password storage. Without a salt, identical passwords produce identical hashes, which means attackers can use precomputed rainbow tables to crack them in seconds. When this breach occured in 2012, MD5 was already considered insecure for password storage. Today, large portions of the 33 million hashed passwords have been fully cracked and the credentials have been used in stuffing campaigns against other platforms for over a decade.

What Was Exposed in the Last.fm Leak

• Email Address
• Username
• Passwords
• Hash Type

Why This Last.fm Data Puts You at Risk

The core risk here is password reuse. Most people in 2012 used the same password across multiple platforms. If your Last.fm password matched your email, banking, or social media account, attackers have had years to test it against those services. Music platform accounts often seem like low-stakes targets, but the email and password combination is what matters. Even if your Last.fm account itself held nothing valuble, those credentials unlock higher-stakes accounts elsewhere.

How Unsalted MD5 Made This Breach Worse

MD5 is a hashing algorithm, not encryption. Passwords stored without a unique random salt are vulnerable to precomputed attacks. Attackers with rainbow tables can match millions of common passwords against a hash database in minutes. Last.fm stored 33 million passwords this way. That means anyone who used a common password, or even a moderatly complex one, was at high risk of having their credential cracked and reused in attacks against other services they held accounts with.

Check If Your Data Was Exposed

HEROIC's free breach search checks your email against 400 billion+ compromised records, including the full Last.fm dataset. Search now to find out if your account was included, and if you haven't changed your Last.fm password since 2012, update it along with any other accounts where you reused the same credentials.