In 2021 data associated with around 700 million LinkedIn profiles was scraped and offered for sale on a hacking forum. LinkedIn said no private data was breached, but the scraped public and inferred data still gave attackers everything needed for targeted phishing and social engineering. It shows that scraped data, not just breached data, carries real risk.
The 2021 LinkedIn data scraping incident created confusion because it was widely described as a data breach, while LinkedIn maintained that its systems had not been breached.
The distinction matters.
In June 2021, reports emerged that data associated with approximately 700 million LinkedIn profiles had been collected and offered for sale on a hacking forum. At the time, that represented a very large portion of LinkedIn’s user base. Reports described information such as names, email addresses, phone numbers, employment information and other profile-related data.
LinkedIn investigated the incident and said the dataset was an aggregation of information from LinkedIn and other websites. The company stated that the information came from publicly viewable member profiles and that its investigation found that no private member data had been exposed or hacked.
For defenders, however, the distinction between a breach and scraping does not eliminate the security risk.
Public information can become much more useful to an attacker when it is collected at scale, organised into a single dataset, combined with information from other sources, and made available to people conducting phishing, impersonation or social engineering attacks.
What Happened and When
The 2021 incident followed an earlier LinkedIn data scraping report in April, when information associated with hundreds of millions of LinkedIn users was reportedly offered for sale. LinkedIn said that earlier dataset was also an aggregation of information from LinkedIn and other websites rather than evidence that LinkedIn itself had been hacked.
In June, another dataset containing information associated with around 700 million LinkedIn profiles was reported as being offered on a hacking forum. Contemporary reporting described the dataset as including contact and professional information.
LinkedIn subsequently reiterated that the incident was not a breach of its private systems. In its December 2021 update, the company said investigators had found that none of its members’ private data had been exposed or hacked. It also stated that unauthorised scraping violated its policies.
That is the central fact of the incident.
The event was a large-scale data scraping and aggregation incident, not a conventional database intrusion.
Scraping Versus a Breach
Data scraping involves collecting information from websites, often automatically and at scale.
Some forms of scraping are legitimate. Search engines, for example, routinely collect publicly accessible information to index websites. LinkedIn itself has explained that scraping is not inherently malicious and that the issue is unauthorised collection and use of its data.
The problem begins when a scraper collects large volumes of information without permission and repackages it for another purpose.
A single LinkedIn profile may reveal relatively little.
It might contain a person’s name, job title, employer, location and professional history.
But a database containing hundreds of millions of profiles is different.
An attacker can search it systematically, identify employees at specific organisations, map reporting structures, identify executives, collect contact information, and build detailed profiles of potential targets.
LinkedIn has acknowledged the difficulty of preventing unauthorised scraping at scale. The company has described using machine learning to detect abusive sequences of member activity, including logged-in accounts used to scrape profile information.
This demonstrates why scraping is a security concern even when the underlying information was visible to users.
The risk can come from aggregation, not just secrecy.
Why Scraped Professional Data Is Still Dangerous
Professional information has particular value to social engineers.
A LinkedIn profile can establish where someone works, what their role is, who they may report to, what industry they operate in, and which professional relationships they maintain.
That information can help an attacker make a fraudulent message appear credible.
Consider an employee whose profile identifies them as a finance manager at a large organisation.
An attacker may use that information to create a targeted phishing email that refers to a realistic business process. If other publicly available information identifies the employee’s colleagues, manager, or suppliers, the attacker can make the communication more convincing.
The Peruvian National Digital Security Centre warned in its 2021 advisory about the LinkedIn scraping incident that exposed information could be used for targeted scams, phishing, brute-force attempts and other attacks.
The same information can also support impersonation.
An attacker does not necessarily need a password to begin an attack. They may first use public information to establish credibility, then attempt to obtain the password through phishing or social engineering.
That creates a chain:
scraped profile data → targeted intelligence → convincing impersonation → credential theft → account takeover
The scraping incident therefore belongs in the same broader security conversation as credential exposure.
How This Data Is Sold and Traded
The 2021 dataset was reportedly offered for sale through a hacking forum. Contemporary reporting also described the information as being made available within criminal communities.
Once information has been aggregated and distributed, defenders have limited control over where it goes next.
A dataset can be copied.
A buyer can download it.
Another criminal can combine it with information from a different source.
A third party can use the resulting dataset for targeted phishing.
Criminal data does not have to remain in the same location to remain useful.
Relevant information can circulate through forums and marketplaces, as well as environments such as Tor, Telegram and I2P. No single source provides complete visibility into every criminal community, private channel, marketplace or dataset.
This is why dark web monitoring should not be understood as checking one website.
The objective is to identify relevant exposure across multiple criminal intelligence sources.
The Link to Social Engineering and Account Takeover
The most important security lesson from the LinkedIn incident is that information does not need to be secret to be dangerous.
An attacker can combine several public data points to create a much more detailed picture of a target.
For example, a scraped profile may reveal an employee’s name and job title. A company website may reveal the organisation’s email format. A public conference page may identify the employee’s recent projects. A separate breach may expose an old email address or password.
Individually, each piece of information may appear manageable.
Together, they can provide an attacker with a practical targeting package.
This is particularly relevant to business email compromise.
An attacker targeting an organisation could use professional information to identify finance staff, executives or employees involved in payments. They could then impersonate one of those people or create a phishing message designed around a known business relationship.
The scraped data is not necessarily the credential that completes the attack.
It can be the intelligence that makes the attack more convincing.
That is why organisations should treat publicly exposed employee information as part of their broader attack surface.
The Lesson: Reduce Exposure and Monitor for Your Data Being Traded
The LinkedIn incident does not mean organisations or individuals should remove every piece of information from the internet.
Professional profiles have legitimate purposes.
The practical lesson is to understand what information is publicly available, how it can be combined with other data, and whether information associated with the organisation is appearing in criminal environments.
Employees should review public profiles and consider whether unnecessary personal information is visible.
Organisations should also maintain strong controls around authentication.
MFA can reduce the impact of stolen passwords. Unique passwords reduce the usefulness of credentials exposed in unrelated breaches. Security awareness training can help employees recognise targeted phishing attempts.
Monitoring provides another layer.
Dark web monitoring for business can help security teams identify when information connected to an organisation appears in criminal intelligence sources.
Employee credential monitoring can provide visibility into employee identities and credentials appearing in known exposures.
DarkThreatX monitors 100B+ records across relevant criminal intelligence sources, including activity associated with Tor, Telegram and I2P. It indexes 1M+ new stealer logs per week, operates 24/7, provides alerts in under five minutes, and reports zero false positives.
For a scraping incident such as LinkedIn, monitoring is not about claiming that every public profile can be tracked everywhere.
It is about identifying relevant information when it appears in monitored criminal sources.
What Organisations Should Do About Scraped Data
A useful response starts with understanding what information is exposed.
Security teams should:
- Identify exposed information. Determine which employee, executive or organisational details have appeared.
- Assess how the information can be combined. Look for links between scraped data, breach records and credential exposures.
- Review employee authentication controls. Confirm that MFA is enabled for important accounts.
- Monitor for exposed credentials. Scraped information becomes more concerning when combined with active credentials.
- Train targeted employees. People in finance, executive, IT and administrative roles may require additional awareness of impersonation and phishing threats.
- Monitor criminal sources continuously. New datasets can appear after the original incident.
The response should focus on the information that can create an actual security consequence.
A public job title is not equivalent to an active password.
An exposed password is not equivalent to a successful account takeover.
But a public job title combined with an exposed corporate email address and stolen password can create a much more serious situation.
Context determines priority.
Why Scraped Data Should Be Part of Threat Monitoring
Traditional breach monitoring focuses on information that was stolen directly from an organisation.
That remains important, but it is only one part of the picture.
Attackers can obtain useful information without compromising the target organisation itself.
Scraping, public records, social media, breached databases, phishing data and infostealer logs can all contribute to the same attack.
That means threat monitoring should consider how different sources connect.
A security team might discover an employee’s public professional profile in one source and the same employee’s corporate credentials in another.
That combination is much more useful to an attacker than either dataset alone.
DarkThreatX’s monitoring approach is designed around this broader criminal intelligence picture. Monitoring includes relevant activity across Tor, Telegram and I2P, alongside forums, marketplaces and other sources.
No monitoring service should claim complete visibility into every criminal environment. The objective is to provide useful, continuous visibility into relevant exposures and give defenders enough information to respond.
Conclusion
The 2021 LinkedIn data scraping incident demonstrated that a security risk does not always begin with a stolen password or an exploited vulnerability.
Data that was publicly visible can still become dangerous when it is collected at massive scale, organised, sold and combined with information from other sources.
LinkedIn stated that its investigation found no private member data had been exposed or hacked and described the dataset as an aggregation of information from public LinkedIn pages and other websites.
That does not make the incident irrelevant.
The value of scraped information comes from how attackers use it.
Professional data can support targeted phishing. Contact information can improve impersonation. Employment details can help identify high-value targets. Combined with stolen credentials, these details can contribute to account takeover and business email compromise.
The lesson is straightforward.
Organisations should understand what information their employees expose publicly, protect accounts with MFA, monitor for compromised credentials, and watch relevant criminal intelligence sources for data associated with their people and business.
Scraped data may be public.
Its use by an attacker does not have to be.
Frequently Asked Questions
What happened in the 2021 LinkedIn incident?
In June 2021, data associated with around 700 million LinkedIn profiles was reportedly collected and offered for sale on a hacking forum. LinkedIn investigated the dataset and said it was aggregated from public LinkedIn information and other websites rather than obtained through a breach of private LinkedIn systems.
Was LinkedIn breached?
LinkedIn said no. The company stated that its investigation found that none of its members’ private data had been exposed or hacked. LinkedIn described the dataset as an aggregation of information from public LinkedIn pages and other websites. It also stated that unauthorised scraping violated its policies.
Why is scraped data dangerous?
Scraped data can give attackers a detailed picture of potential targets. Professional information such as names, employers, job titles and contact details can support targeted phishing, impersonation and social engineering. When combined with breached credentials or other exposed information, scraped data can contribute to account takeover and business email compromise.
What is the lesson from the LinkedIn scraping?
Public information should not automatically be treated as harmless information. Organisations should reduce unnecessary exposure, protect accounts with MFA, monitor for exposed employee credentials, and watch criminal intelligence sources for information associated with their people and business. Monitoring across Tor, Telegram and I2P can provide additional visibility, but no single source has full coverage.
External Reference
LinkedIn: An update on reports of scraped data
https://news.linkedin.com/2021/december/an-update-on-report-of-scraped-data
LinkedIn: Using deep learning to detect abusive sequences of member activity
https://www.linkedin.com/blog/engineering/trust-and-safety/using-deep-learning-to-detect-abusive-sequences-of-member-activity
Forbes: A LinkedIn ‘Breach’ Exposes 92% Of Users
https://www.forbes.com/sites/quickerbettertech/2021/07/05/a-linkedin-breach-exposes-92-of-usersand-other-small-business-tech-news/
