An alleged Russian hacker arrested in the Czech Republic following an FBI-coordinated tip-off is suspected of taking part in a 2012 breach of LinkedIn that resulted in the theft of more than 117 million user passwords, representatives of the professional networking site said Wednesday.
“Following the 2012 breach of LinkedIn member information, we have remained actively involved with the FBI’s case to pursue those responsible,” company officials said in a statement. “We are thankful for the hard work and dedication of the FBI in its efforts to locate and capture the parties believed to be responsible for this criminal activity.”
Word of the arrest came on Tuesday evening in a brief statement issued by Czech Republic officials. It said an unnamed man was arrested in Prague on suspicion of committing unspecified hacks on targets located in the US. The raid was carried out in collaboration with the FBI. According to The New York Times, the suspect was captured on October 5, about 12 hours after authorities learned he was in the country.
His arrest was kept a secret until Tuesday “for tactical reasons,” the paper reported.
A video of the raid released by police is here:
A 2012 hack on LinkedIn is believed to have resulted in the theft of data for more than 117 million user passwords and corresponding e-mail addresses. While the passwords were scrambled using what’s known as one-way cryptographic hashing, the underlying function—SHA1—was so weak that it was trivial for people to undecipher all but a small fraction of them, security researchers have said. LinkedIn has since transitioned to a much stronger form of protection.
The user credentials were available for sale online. Because so many people use the same or very similar passwords to safeguard multiple accounts, the list—and dozens like it from breaches involving other sites—led to even more account compromises. The discovery of the LinkedIn data in May came almost four years after the underlying 2012 breach first came to light. At the time, researchers were aware of only 6 million passwords compromised by the hack.
The Russian suspect was apprehended in a raid at a hotel. Before his arrest, he drove around Prague in a luxury car with a girlfriend, the NYT said, citing police. He didn’t resist arrest, but it was widely reported that he was briefly hospitalized after collapsing.
FBI officials have confirmed the arrest but have yet to provide details. This post will be updated as warranted.