Business networking site LinkedIn has announced it took a hit of up to $1 million due to one of the year's largest reported data breaches.
During its second-quarter earnings call last week, LinkedIn CFO Steve Sordello said the costs involved with recuperating from the incident so far ranged from $US500,000 to $US1 million, which is going toward forensic work and “other elements” relating to the breach.
According to the call, the 175-million-member company continues to strengthen its website's security to protect members and is expected to add $US2 million to $US3 million in costs in the current quarter toward those efforts.
“Since [the breach], we have redoubled our efforts to ensure the safety of our member account on LinkedIn by further improving password-strengthening measures and enhancing the security of our infrastructure and data,” Jeff Weiner, CEO of LinkedIn, said during the call.
“The health of our network as measured by number of growth and engagement remains as strong as it was prior to the incident.”
Earlier this year, attackers dumped 6,458,020 encrypted LinkedIn passwords on a Russian forum.
The stolen passwords were camouflaged using an outdated cryptographic hash function, SHA-1, created by the National Security Agency. In addition to this weakness, LinkedIn failed to add additional security layers, such as salting the passwords, a technique which randomly appends a string of characters.
Following the attack, LinkedIn confirmed in a blog post the addition of new security layers, including the salting of passwords.
This article originally appeared at scmagazineus.com
Copyright © SC Magazine, US edition
Issue: 328 | June 2014
Access CRN's extensive online resources including; email bulletins, community discussions and unique online news.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can log on to the CRN website or start posting comments on articles.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain '@crn.com.au' to your white-listed senders.