Hackers are selling account credentials for 400 million Tumblr and MySpace users

The latest trend in Internet security is selling login credentials from years-old hacks. MySpace and Tumblr have recently joined LinkedIn on the list of websites that had millions of login credentials stolen and put up for sale later.

Tumblr and MySpace were both hacked in 2013, but the number of affected users was never public knowledge until now.

Over 64 million Tumblr accounts and over 360 million MySpace accounts were affected

More than 64 million Tumblr accounts and more than 360 million MySpace accounts were affected by the data breaches, according to information provided to LeakedSource and Motherboard. 

The account credentials were put up for sale on the dark web. According to a source that spoke with Motherboard, the Tumblr account usernames were available, but the passwords were all encrypted using both hashing (assigning each digit into a new letter, number or symbol) and salting (adding a string of digits at the end of the password). While that makes it pretty difficult for hackers to get into the accounts, the passwords can still be cracked, as seen with the LinkedIn hack.

For the 360 million MySpace users, the passwords were stored without salting, so all the stolen information is much more easily accessible to hackers. Not every account affected had a full email, username and password combo with it, but more than 111 million had a username and more than 358 million had a primary password.

Some interesting data from the MySpace breach was published by LeakedSource, including the most popular passwords in the breach. The second most popular password was "password1," and the fourth most was "123456" -- which shows how easy these passwords are to guess in the first place.

Some stricter password requirements and better security measures, like always storing passwords with salts, will drastically cut down on instances of breaches and the usability of that stolen data. If you're worried you may be a part of either of these breaches, make sure you change your password and include a few capital letters, numbers and symbols to make it hard for hackers to crack.

Have something to add to this story? Share it in the comments.