ADDIS ABABA UNIVERSITY

SCHOOL OF GRADUATE STUDIES COLLEGE OF

NATURAL SCIENCE ​
DEPARTMENT OF COMPUTER SCIENCE

Computer security (CoSc 6011)

Assignment One: LinkedIn’s Data Leak Analysis

Prepared by: Naol Teshome

ID: GSE/1055/17

​ ​ ​ ​ ​ ​ ​ ​ ​

Submitted to: Dr. Dagmawi Lemma

Jan 6, 2025
LinkedIn Data Leak (2021) – Analysis
By: Naol Teshome, GSE/1055/17

A) Overview of the Attack

What Happened?

In June 2021, LinkedIn suffered a massive data scraping incident where information from
approximately 500 to 700 million user accounts, representing more than 90% of its total user
base, was extracted and put up for sale on an underground hacker forum. A hacker operating
under the alias “TomLiner” or “GOD User TomLiner posted an advertisement offering the
dataset for sale and even provided a sample containing 1 million user records to demonstrate the
authenticity of the information.

The attacker claimed that the data was collected by exploiting LinkedIn’s Application
Programming Interface (API), which allowed public user profile information to be systematically
gathered. Unlike a traditional cyber breach, where hackers infiltrate internal systems or networks
to steal confidential information, this incident involved automated scraping of publicly available
data at an unprecedented scale, clearly violating LinkedIn’s terms of service.

According to LinkedIn’s official statement, after investigating the claims, the company asserted
that the incident did not constitute a formal “breach” because no private LinkedIn member data
or confidential internal systems were compromised. However, the scraped dataset included
sensitive personal details such as full names, email addresses, phone numbers, physical
addresses, gender, geolocation records, workplace details, and other profile-related metadata.

Although no passwords, financial account information, or direct authentication credentials were

exposed, the aggregation of this much personal information created significant secondary risks.
Individuals whose data was scraped could be targeted for phishing attacks, identity theft,
impersonation schemes, social engineering campaigns, or unauthorized profiling activities.

At the time of reporting, the individual or group behind the scraping remained unidentified.
However, based on the nature of the attack targeting a large volume of public data for resale,
analysts concluded that the likely motivation was financial gain rather than geopolitical
objectives. This suggests that the perpetrators were opportunistic cybercriminals rather than
state-sponsored actors.

The incident served as a stark reminder that publicly accessible information, when aggregated at
scale without users’ explicit consent, can severely impact privacy, data security, and personal
safety. It raised important questions about the ethical responsibilities of platforms like LinkedIn
to implement stronger anti-scraping measures, and also emphasized the need for users to be more
cautious about the amount of personal information they make publicly available.

1 | Page
B) Impact on CIA Triad
Confidentiality​
The confidentiality of user data was severely compromised. Although the information was
publicly accessible in parts, users did not consent to having their entire profiles collected,
aggregated, and resold in bulk. The scraping exposed users to unsolicited contact, phishing, and
social engineering attacks, violating their reasonable expectation of privacy.

Integrity​
There was no evidence that LinkedIn’s data or systems were altered or manipulated. The attack
was limited to extracting data, meaning the integrity of the original user profiles and LinkedIn’s
systems remained intact.

Availability​
The availability of LinkedIn's services was unaffected. Users continued to access their profiles,
and LinkedIn operations remained normal throughout the incident. There was no service
disruption caused by the scraping activities.

C) Vulnerabilities Exploited
The LinkedIn data scraping incident primarily exploited procedural and technical vulnerabilities,
rather than any direct security flaws in LinkedIn’s systems. The key vulnerabilities were as
follows:

1. Insufficient Anti-Scraping Measures

Although LinkedIn deployed basic scraping protections such as rate limiting and bot detection,
these mechanisms were insufficient to prevent sophisticated automated scraping tools. Attackers
likely used rotating IP addresses, headless browsers, and human-like interaction patterns to
bypass simple defenses and systematically harvest data at scale.

2. Public Exposure of Sensitive Information

LinkedIn users often made detailed personal information publicly available on their profiles,
including full names, employment histories, locations, and contact details. Because much of this
information was visible without strong access controls, it became an easy target for mass data
collection. This vulnerability was partly user-driven users voluntarily exposed significant data,
but also reflected default platform settings that encouraged wide visibility.

3. API Abuse and Insufficient Access Controls

The attacker reportedly exploited LinkedIn’s API, which is intended to allow legitimate
third-party integrations and services. However, weak access controls around API use allowed
attackers to make large volumes of queries without triggering sufficient alarms. This highlights a

2 | Page
failure in procedural safeguards such as robust API key management, request throttling, and
behavioral monitoring.

4. Lack of Behavioral Analytics and Anomaly Detection

There is no evidence that LinkedIn’s security systems quickly detected or blocked the large-scale
scraping activity in real time. A more mature security posture would have incorporated
behavioral analytics, traffic anomaly detection, or user interaction monitoring to flag and disrupt
scraping activities much earlier.

All the vulnerabilities exploited were known risks. LinkedIn had even previously engaged in
legal battles, such as the hiQ Labs v. LinkedIn case, over unauthorized data scraping activities,
yet technological countermeasures remained relatively weak at the time of the 2021 incident.

D) Techniques Used
The LinkedIn data leak primarily involved the following techniques:​

●​ Automated Data Scraping: Attackers deployed bots and scripts to systematically collect
data from publicly accessible LinkedIn user profiles. This method exploited the visibility
of user information intended for networking purposes. ​
●​ Web Crawling and Parsing: Scrapers navigated LinkedIn's web pages, parsed the
HTML content, and extracted specific data fields such as names, email addresses, and job
titles. Tools like Selenium were commonly used for such operations.
●​ Potential API Abuse: There is speculation that attackers may have misused LinkedIn's
API, which is designed for legitimate user interactions and third-party applications, to
expedite the data extraction process. ​

No evidence suggests that social engineering tactics or insider threats were involved. The attack
was conducted entirely through external, automated methods that exploited publicly available
data.

E) Adversary Model
Internal or External

The adversary was external to LinkedIn. They had no special access rights or insider credentials.

Motivation

The likely motivation was financial. Selling large datasets on hacker forums can yield significant
profits, either directly or by enabling downstream cyberattacks like phishing, credential stuffing,
or identity fraud.

3 | Page
Skill Level

The adversary demonstrated moderate technical skill. Scraping at such a large scale while
avoiding basic detection mechanisms requires an understanding of web systems, rate-limiting
bypass techniques, and automation. However, the attack did not exhibit the sophistication of an
Advanced Persistent Threat (APT), where there was a long-term effort in Reconnaissance and
privilege escalation.

Thus, the attacker could be classified as a professional cybercriminal group rather than
opportunistic amateurs ("script kiddies") or highly skilled nation-state actors.

F) Threat and Risk Perspective

Threat Actor and Vector

The LinkedIn data scraping incident involved an external threat actor, likely financially
motivated cybercriminals seeking to profit by selling aggregated user data. The primary threat
vector was the exploitation of publicly accessible user profiles through automated scraping tools
and potential API misuse.

Asset at Risk

The primary asset at risk was the personal identifiable information (PII) of LinkedIn users,
including names, email addresses, phone numbers, employment history, and other profile
metadata. Although the data was publicly visible, its large-scale aggregation and sale
substantially increased its value and sensitivity.

Impact of the Attack

The impact of the attack is considered high. Compiled user data can be exploited for a range of
malicious activities such as phishing attacks, identity theft, targeted scams, and reputational
damage. Even without passwords or financial details, aggregated datasets offer attackers a rich
foundation for further exploitation.

Likelihood of Similar Attacks

The likelihood of similar scraping attacks remains high without significant enhancements to
platform security measures. Public-facing data repositories are persistently attractive targets for
adversaries, especially when anti-scraping defenses are limited.

Risk Assessment

The scraping incident exploited weaknesses in LinkedIn’s defenses against automated access and
API abuse. According to MITRE ATT&CK mappings, the adversary leveraged reconnaissance
techniques (T1589 – Gather Victim Identity Information, T1596 – Search Open
Websites/Domains) to gather user identity data. From an OWASP perspective, the attack reflects

4 | Page
a failure in authentication and access control mechanisms (A07). NIST’s risk framework assesses
the exposure of personally identifiable information (PII) through such methods as High Impact
and High Likelihood, creating a Critical Risk situation.

This combination of public data exposure, procedural gaps, and systemic weaknesses
underscores the need for advanced anti-scraping protections, tighter API governance, and
behavioral anomaly detection systems to lower risk levels in the future.

Risk Matrix

ASSET Threat Impact Likelihood Risk level

User PII Data scraping and unauthorized High High Critical
aggregation

5 | Page