Lawyers seek $5 million in damages over LinkedIn hack

In an age of hackers, hacktivism and hyperbolized “cyber-terrorism” rhetoric by way of Congress, what’s the price of keeping your online identity private? Lawyers representing a woman who had her LinkedIn password stolen say around $5 million.

Attorneys representing Katie Szpyrka out of Illinois have filed a lawsuit against the networking site LinkedIn, asking for upwards of $5 million in damages because they say the website failed to live up to the user agreements and privacy policies that they force users to acknowledge.

According to court documents, LinkedIn’s administrators “failed to properly safeguard its users’ digitally stored personally identifiable information including email addresses, passwords and login credentials,” a vulnerability that ended with millions of passwords stolen earlier this month.

The plaintiffs argue that LinkedIn did not incorporate industry standard encryption when safeguarding their passwords which, the lawsuit claims, requires “at least the additional process of adding ‘salt’ to a password before running it through a hashing function.”

“This procedure drastically increases the difficult of deciphering the resulting encrypted password,” the court document claims.

At the time of the hack, however, LinkedIn’s information was not “salted” but merely encrypted using basic hash protection.

On June 6, hackers infiltrated LinkedIn’s servers and stole roughly 6.5 million passwords, or almost one-fifth of the company’s user base. The company was using some encryption to protect the passwords — but not enough, apparently — and was driven to warn users to change their log-ins in order to avoid unauthorized access to their accounts.

No user names were released in the hack, but the lifting of private data still violates the guarantee with the company has with paying members, attorneys attest.

A public relations associate for LinkedIn tells ZDnet that “No member account has been breached as a result of the incident, and we have no reason to believe that any LinkedIn member has been injured,” but attorneys representing the plaintiff beg to differ.

LinkedIn’s security procedures “fall well short of this level of security,” the plaintiffs insist. LinkedIn spokeswoman Erin O’Harra has fired back in an email response to IDG News Service that the suit “without merit” and said her company would defend itself “vigorously.”

The class action suit was filed last week in US District Court in Northern California. The plaintiffs are seeking class action status so that others victimized by the hack can join the case.

You can skip to the end and leave a response. Pinging is currently not allowed.

Leave a Reply

Powered by WordPress | Designed by: Premium WordPress Themes | Thanks to Themes Gallery, Bromoney and Wordpress Themes