The Breach That Never Really Ended
By John R. Kennedy ·
What the LinkedIn breach taught us about the information we can never take back
I remember when creating an account on a website was a relatively simple decision. You provided an email address, created a password, and perhaps answered a few questions about yourself. In exchange, you gained access to something useful, whether that was an online store, a professional network, or one of the many services that emerged as the internet became part of everyday life.
Most of us didn't give much thought to what happened to our information after we provided it. We assumed the companies operating these services had a responsibility to protect it, and we generally trusted that they would. There was little reason for the average person to understand how passwords were stored, how databases were secured, or what might happen if someone gained unauthorized access to the systems holding their information.
I was already working in technology during those years, and even among people who understood the risks, the emphasis was often on protecting systems rather than questioning how much information we were collecting in the first place. Businesses needed customer information to operate, websites needed accounts to identify their users, and the internet was expanding too quickly for many of us to spend much time reconsidering the assumptions behind those arrangements.
Looking back, I think we were participating in an enormous experiment without fully appreciating what we were creating. We were building a digital world in which organizations accumulated increasingly detailed information about people, while those same people had remarkably little understanding of where their information was going or what might eventually happen to it.
The 2012 LinkedIn data breach provides an interesting illustration of how those decisions could produce consequences that extended far beyond the original incident.
At the time, LinkedIn had become an important part of professional life. People used it to maintain business relationships, search for employment, establish credibility, and remain connected with colleagues. Unlike many other social networks, its purpose encouraged users to associate their accounts with their real identities and professional histories.
That made the service useful, but it also meant that the information associated with an account could have significance well beyond the website itself.
In June 2012, LinkedIn acknowledged that approximately 6.5 million passwords had been stolen. The company responded by disabling passwords it believed were at risk and strengthening its security measures. For people following the incident, it was another reminder that even large technology companies could experience serious security failures.
The story might have ended there, at least in the minds of most users, if not for something that happened four years later.
In May 2016, information stolen during the original breach resurfaced online. This time, the scale appeared substantially larger. Reports described approximately 117 million accounts with associated password information, and LinkedIn confirmed that the newly surfaced records came from the 2012 incident rather than a new intrusion.
Four years had passed, but the consequences of the original theft were still unfolding.
I find that timeline particularly revealing because it challenges the way we usually think about security incidents. When a company announces a breach, we tend to imagine an event with a beginning and an end. Someone gains unauthorized access, information is stolen, the vulnerability is addressed, and affected customers are notified. We change our passwords, perhaps monitor our accounts for suspicious activity, and eventually move on.
From an operational perspective, that sequence makes sense. The organization needs to identify what happened, prevent further unauthorized access, and restore confidence in its systems.
But the information that was stolen doesn't necessarily disappear when the security problem is resolved.
It may be copied, exchanged, stored, combined with other information, or rediscovered years later. The organization can repair its systems, but it cannot reliably retrieve every copy of information that has already escaped its control.
This is one of the fundamental differences between protecting a physical asset and protecting information.
If someone steals a vehicle, the owner loses possession of it. The vehicle may eventually be recovered, and while the experience can be expensive and disruptive, the boundaries of the loss are relatively understandable.
Information behaves differently. Someone can steal a copy of a database without removing the original. The organization may continue operating normally, and the people whose information was copied may have no immediate indication that anything has changed.
The loss isn't necessarily the information itself. It's the ability to control who possesses it and how it might be used.
That distinction becomes even more important when we consider the nature of the information involved in the LinkedIn breach.
Passwords were the most obvious concern because they could potentially allow unauthorized access to accounts. LinkedIn had stored the passwords as hashes, which means they weren't simply saved as readable text. However, the protections used at the time were weaker than modern recommended password-storage practices, making many passwords vulnerable to being recovered through automated guessing.
The company subsequently strengthened those protections, but the stolen information remained outside its control.
The problem also extended beyond LinkedIn because people frequently reused passwords across multiple services. Someone who used the same password for a professional networking account and a personal email account could potentially face consequences involving both, even though only one organization had experienced the breach.
In that situation, the relationship between two otherwise unrelated accounts becomes important. The person creating the accounts may never have considered that connection, but someone possessing the stolen information could exploit it.
I've always found password reuse to be an interesting example of how ordinary human behavior can create risks that aren't obvious when we consider each decision independently. Most people weren't reusing passwords because they wanted to compromise their security. They were trying to manage an increasingly complicated digital life in which every new service demanded another set of credentials.
The convenience made sense in isolation. The cumulative consequences were harder to recognize.
But there's another aspect of the LinkedIn breach that interests me even more than the passwords.
A professional networking account represents part of a person's identity. It connects a name to an email address, employment history, professional relationships, and other information that can help establish credibility. Much of that information is intentionally shared because the purpose of the service is to make professional connections.
That doesn't mean every piece of information on a LinkedIn profile was stolen in the 2012 breach. LinkedIn's notification identified email addresses, hashed passwords, and internal member identifiers as the affected data. The broader professional information associated with the service matters for a different reason: it illustrates how a seemingly limited set of stolen records can exist within a much larger digital identity.
An email address may appear relatively harmless because we routinely share it with businesses, colleagues, and acquaintances. But when that address is connected to other records, it can help establish relationships between information collected in completely different circumstances.
Someone might use the same email address for professional networking, shopping, travel reservations, and numerous other services. Each organization sees only the portion of the person's life relevant to its business, but those fragments can potentially be connected when information is combined.
This is where I believe our early assumptions about digital privacy began to create problems that we're still trying to understand.
We approached online services as separate relationships. We provided information to a particular company because we wanted access to something that company offered. We might have understood that the company would retain our information, but we rarely considered how that information could become useful to someone operating entirely outside the original relationship.
The internet made it remarkably easy to create these connections, and over time we became accustomed to treating the information required to establish them as a routine cost of participation.
We were exchanging pieces of our identities for convenience, often without recognizing that the exchange could be difficult or impossible to reverse.
I don't mean that every company collecting information was behaving irresponsibly or that every person creating an account was making a mistake. Many of these services provided genuine value, and the information they collected was necessary to deliver it.
The problem was that our understanding of the long-term consequences hadn't kept pace with the speed at which we were creating digital relationships.
A company might have viewed an email address as a customer identifier. The customer might have viewed it as a convenient way to sign in. Someone obtaining a large collection of stolen records could view the same information as a means of connecting identities across unrelated services.
The information hadn't changed, but its potential uses had.
This brings me back to the idea that everything is an asset.
When we recognize information as an asset, we begin to appreciate that its value depends partly on the circumstances surrounding it. An email address, considered by itself, may not appear particularly valuable. But the relationships between that address and other information can make it considerably more significant.
Those relationships can create value for legitimate purposes, such as helping a business recognize an existing customer or allowing someone to recover access to an account. They can also create opportunities for misuse when information moves beyond the boundaries of the relationship in which it was originally provided.
What makes this particularly challenging is that people often have little practical ability to separate those relationships after they've been established.
We can change a password, and doing so is an important way to reduce the risk associated with stolen credentials. We can sometimes change an email address, although that may require updating years of accounts and correspondence.
But we cannot easily change our employment history, erase every association between our identity and an old account, or ensure that information already copied by someone else will never be used again.
Some digital assets can be replaced. Others are inseparable from the history of the people they describe.
The 2012 LinkedIn breach demonstrated this problem in a relatively straightforward way. Information stolen during one event remained relevant years later, and the people affected had limited control over what happened to copies of that information in the meantime.
Now consider how much more complicated our digital lives have become since then.
We use online services to manage finances, communicate with family, store photographs, maintain medical records, and organize nearly every aspect of our professional lives. Many of these services are connected through shared accounts, third-party applications, and automated systems that exchange information on our behalf.
Each connection may provide a legitimate benefit, but it also creates another relationship involving information that could become valuable outside its original purpose.
Artificial intelligence introduces an additional dimension because it can make those relationships easier to discover and interpret.
A collection of records that once required substantial human effort to examine may become easier to organize, compare, and analyze. Information from different sources can potentially be connected through patterns that aren't immediately obvious, allowing systems to develop a more detailed understanding of the people represented in those records.
This capability has tremendous potential for legitimate uses. It could help individuals organize their information, identify inconsistencies, and understand relationships that would otherwise remain hidden.
But the same underlying capability can also increase the usefulness of information that has already escaped its original boundaries.
A stolen email address doesn't suddenly reveal someone's entire life simply because artificial intelligence exists. However, when combined with other accessible information, it may become one element in a much larger picture. AI can reduce the effort required to identify connections, evaluate patterns, and produce conclusions from collections of records.
And those conclusions don't necessarily have to be correct to cause harm.
Imagine someone assembling information about a person from several unrelated sources. One record contains an outdated address, another references a former employer, and a third includes information about a business relationship that ended years earlier.
An AI system might connect those records and produce an explanation that appears coherent, even though some of the relationships are no longer relevant. If that explanation is subsequently treated as reliable, the person represented in the records may face consequences from information they never intended to combine and conclusions they never had an opportunity to challenge.
This possibility concerns me because we've spent years discussing the importance of protecting information from unauthorized access, while paying considerably less attention to what happens when information is interpreted outside the circumstances that originally gave it meaning.
A data breach can expose information, but the consequences of that exposure depend upon how the information is subsequently used.
The original theft may be only the beginning of the story.
I think there's a tendency to look back at incidents like the LinkedIn breach and conclude that the lesson is simply to use stronger passwords and enable additional security protections. Those are sensible measures, and I would encourage people to use them. Unique passwords, password managers, and multifactor authentication can substantially reduce the likelihood that stolen credentials will compromise additional accounts.
But if we stop there, I think we miss something more important.
The broader lesson is that information can continue creating consequences long after we've forgotten why we provided it.
This is especially relevant as we enter an era in which AI assistants may become responsible for managing increasingly large portions of our digital lives. We may give these systems access to correspondence, documents, calendars, financial information, and personal histories because doing so allows them to provide more useful assistance.
In many cases, that access will be entirely reasonable. An assistant that understands our circumstances can potentially help us make better decisions and accomplish tasks that would otherwise require considerable time and effort.
But I wonder whether we're approaching these new relationships with some of the same assumptions that shaped our early experiences with the internet.
We see the immediate benefit of sharing information and assume that the organization or system receiving it will use it appropriately. We may examine a privacy policy, review a permission request, or decide that a service has earned our confidence.
What we often cannot know is how the value of that information might change over time, what new capabilities may eventually become available, or how information collected for one purpose might be used in circumstances nobody originally anticipated.
The LinkedIn breach didn't involve artificial intelligence in the way we understand it today, but it illustrates the importance of considering the future life of information beyond the moment we surrender control of it.
The information stolen in 2012 became the subject of renewed concern in 2016 because copies remained available and useful. The original incident hadn't changed, but our understanding of its scope had.
I suspect the same principle will apply to many of the decisions we're making about AI today.
We may be comfortable allowing an assistant to examine personal information because the immediate purpose seems harmless. We may trust a service to retain records because it offers a useful capability. And we may assume that deleting an account or withdrawing permission will restore the control we previously possessed.
Sometimes those assumptions will be justified. Other times, copies, retained records, legal obligations, or information already shared with other systems may limit what can actually be reversed.
The difficulty is that we often discover those limitations only after circumstances change.
I don't believe the answer is to withdraw from the digital world or become suspicious of every technology that asks us to share information. The internet has created extraordinary opportunities, and I expect artificial intelligence to expand those opportunities in ways we're only beginning to imagine.
But I do believe we need to develop a more mature understanding of the assets we're placing into these systems.
That begins with recognizing that information has a life beyond the application in which we created it. Its value can change, its relationships can expand, and its potential consequences can persist even when the original purpose has disappeared.
It also requires us to consider whether the organizations and technologies we depend upon are designed to respect those realities. Protecting information while it's stored is essential, but so is understanding how it moves, who is permitted to use it, and what happens when the relationship that justified its collection comes to an end.
For much of the internet's history, we treated the creation of a digital account as a small transaction. We gave a company some information, received a service in return, and rarely thought about the exchange again.
The LinkedIn breach reminds us that the transaction may have been much more consequential than it appeared.
Four years after the original incident, information that users had entrusted to a professional networking service was still creating new security concerns. The company had taken steps to improve its protections, and affected users could change their passwords, but neither action could guarantee that every stolen copy had disappeared.
The event was in the past. The information wasn't.
As we begin entrusting artificial intelligence with increasingly detailed knowledge of our lives, I think that's a distinction worth remembering. We're not simply deciding whether a service is useful today. We're making decisions about information that may retain its significance long after the technology, the company, or even our reasons for sharing it have changed.
And if the history of the internet has taught us anything, it's that we haven't always been very good at anticipating what our information might become valuable for tomorrow.
Continue reading: When AI Trusts Something, Should You?