Change your Last.fm password now, there may have been another security breach
24-hours after LinkedIn confirmed a massive password leak, online music streaming service Last.fm has issued a statement saying that it's currently investigating whether it too has leaked some of its users' passwords.
Context & Ripple Effects
Last.fm is no stranger to break-ins at its own front door: back in March 2009 the BBC reported that user information had been stolen from the music site, days after hackers broke into Spotify — an early sign that streaming services were attractive targets long before this week.
What makes today's statement different is timing and scale: it lands barely 24 hours after LinkedIn confirmed a massive password leak of its own, and just two days after The Next Web reported that LinkedIn's iOS app was transmitting users' calendar names, emails and meeting notes in plain text. With Last.fm's own investigation still unconfirmed, the company is urging password changes as a precaution — and the story has travelled fast, picked up by outlets from GigaOM to the Los Angeles Times and Computerworld.
First-order effects
- Last.fm users are being told to change their passwords now, before the investigation concludes — a precautionary reset that treats the breach as probable even though the company has not confirmed one.
- Anyone who reused a Last.fm password on other services faces immediate risk if the dump proves real, since LinkedIn's already-confirmed leak gives attackers a ready-made list of email-password pairs to test elsewhere.
Second-order effects
- Every major consumer web service with an aging password database now faces the same question Last.fm did this week — whether to wait or pre-emptively force resets — because each confirmed dump raises the odds that its users' credentials appear in the next one.
- LinkedIn's compounding week — a confirmed password leak stacked on the plain-text calendar transmission story — puts its trust-and-safety posture under scrutiny at exactly the moment it is courting advertisers and closing acquisitions like the $119 million SlideShare deal.
Third-order effects
- If the pattern holds — big dumps at LinkedIn, then Last.fm within days — credential reuse becomes the systemic weak point, pushing the industry toward mandatory per-service salting and hashing upgrades and, eventually, authentication methods that stop treating a single password as adequate.
- Consumer platforms may face growing pressure from regulators and enterprise customers alike to disclose breaches faster than Last.fm's open-ended 'investigating' stance, since syndication across eight mainstream outlets within a day shows how quickly disclosure gaps become reputational ones.
The trend: 2012's cascade of confirmed password leaks is turning credential reuse between services into the defining consumer-web security problem, forcing platforms to treat proactive resets and stronger hashing as baseline practice rather than incident response.