Last.fm 2012 Data Breach
Platform · Music tracking and discovery · Streaming and analytics platform · Global
Last.fm Music Tracking Platform Breach (2012, Disclosed 2016): 43 Million User Accounts Including Passwords Exposed
Music tracking and recommendation service.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
23/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
43.6MRecords
2012Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
In March 2012, Last.fm was hacked and roughly 43.5 million accounts (about 37 million unique email addresses) were exposed, though the scale was not known until the data surfaced publicly in September 2016. Exposed data included usernames, email addresses, passwords stored as unsalted MD5 hashes, and website activity. Researchers reported cracking over 96% of the hashes within two hours.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
43.6M records analyzed
About Last.fm
Last.fm is a music-tracking and recommendation service that logs listening activity ("scrobbling") and connects users with music discovery features and a community.
Why They Hold Your Data
Music-tracking and discovery platforms collect user accounts, emails, usernames, listening histories, social connections, and analytics records tied to long-term media behavior.
Recent Developments
Last.fm was aware of an incident in 2012, but the full scale only became clear when the data was released publicly in September 2016.
Data Points Exposed
4 verified field types
Activity History
Email Address
Password High
Username
Breach Impact
With unsalted MD5 hashes almost entirely cracked, the breach exposed effectively plaintext credentials for tens of millions of users, driving broad credential-stuffing risk.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation