Credentials and information of 26 million users of the LiveJournal platform are being sold online and on the dark web.
Blogging platform LiveJournal . appears to have been hacked in 2014, according to reports from multiple hackers who have now decided to sell the company's database ( which includes credentials and user data). The database is already on hacking forums and the dark web
Rumors of breach on the platform have been circulating online for about two years. The first ones were released in October 2018, when many users reported receiving their unique/old LiveJournal passwords in spam emails.
Although no breach was ever confirmed, the rumors didn't stop. In recent months, DreamWidth, a blogging platform built from the old LiveJournal codebase, has been under attack.
In recent weeks, DreamWidth has reported in blog posts and tweets that it has been the target of multiple credential stuffing attacks. The company says that hackers used combinations of old LiveJournal usernames and passwords to compromise DreamWidth accounts (as the two platforms share the same codebase and users).
However, despite evidence that hackers have gained access to a large number of LiveJournal credentials, Rambler Group, the company behind the LiveJournal platform, has refused to officially acknowledge any breach in communication with DreamWidth administrators.
But the service Have I Been Pwned (HIBP) appears to confirm the breach rumors, after announcing that database user LiveJournal's
The database contains usernames, emails, and passwords ( in plain text) of 26,372,781 LiveJournal users.
The LiveJournal database has been "in circulation" for a long time
Copies of the data were found on several hacking forums. Several ads posted by data brokers. In these ads, the hackers were selling or willing to buy LiveJournal's database. Some of the ads have been circulating for months. The hackers say the breach had been going on since 2014, but the company was unaware of it.
From these ads it appears that hackers were exchanging data with each other and using it for other attacks.
However, at some point they were leaked online. The first report of the LiveJournal database leak was in July 2019, when the service WeLeakInfo announced that it had obtained a copy of the database.
Over time, the data has been leaked to more sites. Recently, an ad was posted on a dark web marketplace, where the base is being sold for just $35.
A few days later, the database was also found on a well-known hacking forum and began to circulate widely, as a free download, on Telegram channels and file-sharing portals.
For now, the DreamWidth platform is still being attacked with old LiveJournal credentials, but the company is rolling out updates. However, the risk is not limited to DreamWidth accounts.
If users used old LiveJournal usernames and passwords on other sites, their accounts were at risk.
LiveJournal users can visit the HIBP portal and check if their credentials were included in the data breach in 2014.
Users who changed their passwords after 2014 are likely safe. However, if they use those credentials on other accounts, they should change them.
