LinkedIn data breach COMPROMISES LinkedIn
The incident was a breach of LinkedIn's network and user database.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“LinkedIn had just been breached but they didn’t know it yet”
Episode
02 March 2021 Official episode · Official transcript
incident response cybercrime
The episode describes the 2012 compromise of LinkedIn and subsequent intrusions involving Dropbox and Formspring, the investigation that identified Yevgeniy Nikulin, and his later prosecution.
Topics: Remote-access VPN compromise, Residentially hosted web servers, Malicious PHP file upload and execution, Virtual machine escape to a host computer, SSH access and brute-force password attacks, Private-key theft and public-key authentication, Password-hash cracking with GPUs, Unsalted versus salted password hashes, Credential and password reuse, User-agent and IP-address correlation, Database access and SQL queries, Incident response war rooms, Log preservation and forensic investigation, Cross-border subscriber-data requests through MLAT
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
LinkedIn data breach COMPROMISES LinkedIn
The incident was a breach of LinkedIn's network and user database.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“LinkedIn had just been breached but they didn’t know it yet”
LinkedIn data breach INITIAL_ACCESS_VIA VPN
The hacker gained direct access to LinkedIn through an employee's VPN profile and credentials.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“connected directly into LinkedIn’s VPN server”
LinkedIn data breach INVOLVES cockeyed.com
The hacker used access to cockeyed.com, hosted at the engineer's residence, as a path toward the engineer's computer and LinkedIn access.
Explicit Confidence 94% · Jack Rhysider EP 86 Details
“The hacker got shell access to the website cockeyed.com”
LinkedIn data breach INVOLVES madnez.php
The hacker uploaded and executed a malicious PHP file named madnez.php while compromising the web server.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“he uploaded a couple malicious PHP files. One was specifically called madnez.php”
LinkedIn data breach INVOLVES brute-force password attack
The hacker brute-forced the iMac login by trying thousands of passwords against a guessed username.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“he just started hammering away, trying thousands and thousands of passwords”
LinkedIn data breach INVOLVES virtual machine escape
After compromising a virtual machine, the hacker escaped to the iMac host computer through the virtual IP interface.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“the hacker got into the virtual machine and then got into the host computer from there”
LinkedIn data breach INVOLVES Public-key authentication
The hacker stole the engineer's private key, which was used for public-key authentication to LinkedIn systems.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“he found a private key to LinkedIn”
LinkedIn data breach INVOLVES Password hash cracking
The stolen LinkedIn password hashes were posted for help cracking, and the hacker later used cracked passwords to access accounts.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“the hacker wanted to find a way to crack these passwords”
LinkedIn data breach INVOLVES User-agent fingerprinting
Investigators used the hacker's distinctive user agent to correlate activity across IP addresses and services.
Explicit Confidence 98% · Jack Rhysider EP 86 Details
“if there was a matching user agent, then you could know that that’s probably the same person”
LinkedIn data breach INVOLVES Sputnik user agent
The hacker's user agent included the unusual string Sputnik, which investigators used as an identifying indicator.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“The hacker’s user agent was unique. It actually had the word Sputnik in the end”
LinkedIn data breach INVOLVES SSH
The hacker accessed the LinkedIn database server using SSH and then ran database queries.
Explicit Confidence 96% · Jack Rhysider EP 86 Details
“they did. There were logs of the hacker logging into the database server and then accessing the database”
Dropbox breach COMPROMISES Dropbox
Dropbox confirmed unauthorized access to its corporate network and later determined that user details had been stolen.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“Once Dropbox did confirm there was unauthorized access into the network”
Dropbox breach INITIAL_ACCESS_VIA credential reuse
The hacker appears to have entered Dropbox using a reused password belonging to a Dropbox engineer; Jack is uncertain whether the same password was used at Dropbox.
Uncertain Confidence 89% · Jack Rhysider EP 86 Details
“But did this engineer use the same password where he worked too, at Dropbox? I don’t know for sure but the hacker was able to login as the engineer at Dropbox.”
Dropbox breach INVOLVES credential reuse
The Dropbox engineer acknowledged reusing the same password across several personal accounts, enabling the hacker to access additional accounts.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“His Twitter, Facebook, LinkedIn, and Google accounts all had the same password”
Formspring breach COMPROMISES Formspring
The Formspring incident involved unauthorized access to the server and theft of user information.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“Formspring had no idea they were breached”
Formspring breach INITIAL_ACCESS_VIA SSH
The hacker obtained Formspring administrator credentials and logged into the server using SSH.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“the hacker got one of the admin usernames and passwords from Formspring’s server and logged in using SSH”
Formspring breach INVOLVES madnez.php
The hacker installed madnez.php on the Formspring server to maintain access.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“He was able to install a malicious program called madnez.php on the server so that he could get back in anytime he wanted”
Formspring breach INVOLVES SQL injection or database command execution
The hacker used the web administration panel to execute SQL commands and extract user information from the database.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“he was able to run SQL commands on the database and grabbed a large amount of user info”
LinkedIn data breach RELATED_TO Dropbox breach
The FBI linked the LinkedIn and Dropbox incidents through matching IP addresses, user agents, and related account activity.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“Someone had breached LinkedIn, Dropbox, and Formspring all from the same IPs and same user agents with a trail connecting it all”
LinkedIn data breach RELATED_TO Formspring breach
The LinkedIn, Dropbox, and Formspring cases shared indicators of compromise, including IP addresses, user agents, browsers, and operating systems.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“In all three attacks they found similar IOCs, or indicators of compromise; the same IPs, the same user agents, the same browser and OS”
LinkedIn data breach ASSOCIATED_WITH Yevgeniy Nikulin
Yevgeniy Nikulin was associated with the LinkedIn breach through multiple investigative trails, and the jury later found him guilty on all nine counts involving LinkedIn, Dropbox, and Formspring.
Explicit Confidence 98% · Jack Rhysider EP 86 Details
“The jury found him guilty on all nine counts”
Dropbox breach ASSOCIATED_WITH Yevgeniy Nikulin
Kislitsin told the FBI that Yevgeniy Nikulin was the person who broke into Dropbox and still had access to it; this is an attributed account, not an independently stated fact in the episode.
Attributed Confidence 94% · Jack Rhysider EP 86 Details
“he told them that Yevgeniy Nikulin was the person who broke into Dropbox and still had access to it”
Formspring breach ASSOCIATED_WITH Yevgeniy Nikulin
Kislitsin also said that Yevgeniy had the Formspring data with the goal of selling database dumps for money; this relationship is attributed to Kislitsin's statement.
Attributed Confidence 94% · Jack Rhysider EP 86 Details
“and had the Formspring [00:40:00] data, all with the goal to sell the database dumps on the black market for money”
Federal Bureau of Investigation USES Mutual Legal Assistance Treaty
The FBI used the Mutual Legal Assistance Treaty process to request Russian subscriber records for suspicious IP addresses.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“the FBI requested from Russia subscriber records through MLAT”
Kislitsin ASSOCIATED_WITH Yevgeniy Nikulin
Kislitsin provided information to the FBI identifying Yevgeniy as the person behind the Dropbox and Formspring activity; the association is based on Kislitsin's attributed statement.
Attributed Confidence 91% · Jack Rhysider EP 86 Details
“he told them that Yevgeniy Nikulin was the person who broke into Dropbox”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:54:39.745755+00:00