LinkedIn Data Breach: 66 Million Scraped Records Exposed in an Unsecured Database

What Happened: 66 Million Scraped LinkedIn Records Exposed

Starting October 5th, 2018, researchers identified an unsecured MongoDB database containing personal information scraped from LinkedIn profiles. What began as a single exposed instance grew as further investigation uncovered additional databases holding the same kind of data—bringing the total to approximately 66,147,856 unique records.

The database's owner was never identified. As with similar cases, the exposed records were uploaded to Have I Been Pwned so affected individuals could check whether their information was included.

What Data Was Exposed

The exposed records included:

• Full names
• Personal and professional email addresses
• Location details
• Skills and employment history
• Phone numbers
• IP addresses
• Physical addresses

No financial data—credit card numbers, passwords, or similar credentials—was found in the exposed set. That's a meaningful distinction, but it doesn't make the exposure low-risk: names, emails, employers, and phone numbers together are more than enough for targeted phishing or social engineering.

Is Web Scraping Legal or Not?

Scraping data from a website without consent generally violates that site's terms of service, but "against the terms of service" and "illegal" aren't automatically the same thing—and this is genuinely contested legal territory. The most relevant precedent is hiQ Labs v. LinkedIn, in which LinkedIn tried to block a data analytics company from scraping public profile data. U.S. courts ultimately sided with hiQ, ruling that scraping publicly accessible information generally does not violate the Computer Fraud and Abuse Act—though the case doesn't settle every scenario, and using scraped data against the interests of the people or platform it came from can still create legal exposure, particularly under data protection law.

This Isn't LinkedIn's Only Scraping Incident

This 2018 case is small next to what happened to LinkedIn three years later. In April 2021, a much larger scraping operation harvested data from roughly 700 million LinkedIn profiles—the vast majority of LinkedIn's user base at the time—and the dataset was later sold and circulated in hacking communities. Have I Been Pwned's entry for that incident catalogs 125.7 million unique email addresses from the exposure, alongside names, locations, genders, job titles, and education details.

LinkedIn's official position on the 2021 incident was that it "did not constitute a data breach," since the scraped data was already publicly visible on profiles rather than pulled from a hacked internal system. That's a legally meaningful distinction, but it's worth noting for anyone piecing together "how many times has my LinkedIn data been exposed": if your profile was public in 2018 or 2021, it's plausible your information appears in more than one of these datasets.

How Not to Be Scraped: Basic Steps

• Limit what you make publicly visible on professional profiles—a phone number or personal email doesn't need to be public just because your job title is.
• Use separate credentials (and ideally separate email addresses) for financial accounts versus social and professional platforms, so one exposure doesn't cascade into another.
• Periodically review a platform's privacy settings; defaults tend to favor visibility, not privacy.
• Think about combined exposure risk: a name and job title alone are low-risk, but the same name paired with a phone number, employer, and location is enough for a convincing phishing attempt.

What Is the GDPR?

The General Data Protection Regulation, enforced since May 25, 2018, protects the personal data of EU and EEA residents regardless of where the company processing that data is based. Non-compliance can carry fines of up to €20 million or 4% of global annual turnover. See how bug bounty programs support GDPR compliance for more on what that means in practice.

LinkedIn Data Breach: FAQ