Last.fm data breach

Risk level: Medium 48/100

What happened

In March 2012, the music website Last.fm was hacked and 43 million user accounts were exposed. The passwords were stored as unsalted MD5 hashes.

Recommended steps if you were in the Last.fm breach:

Work through these steps, most urgent first:

Change the password on every affected site immediately, and anywhere you reused it.
Sign out of all sessions and revoke app passwords, API keys and connected apps.
Turn on two-factor authentication (authenticator app or security key) wherever it is offered.
Use a unique password for every site so one breach cannot unlock other accounts.
Use a password manager to generate and store strong, unique passwords.
Expect targeted phishing emails that mention this breach. Do not click unexpected links.
Check other accounts that use the same username or email and secure them.
Keep an eye on your accounts for logins or changes you do not recognise.
Subscribe to breach alerts so you hear about future breaches quickly.