Data breach
Last.fmlast.fm
37 217 682 accounts exposed in a breach dated 2012-03-22.
Breached2012-03-22Added to HIBP2016-09-20 UTCUpdated by HIBP2016-09-20 UTCAccounts37 217 682Domainlast.fm
Verified
What happened in Have I Been Pwned’s words
In March 2012, the music website Last.fm was hacked and 43 million user accounts were exposed. Whilst Last.fm knew of an incident back in 2012, the scale of the hack was not known until the data was released publicly in September 2016. The breach included 37 million unique email addresses, usernames and passwords stored as unsalted MD5 hashes.
Exposed data as HIBP classifies it
- Email addresses
- Passwords
- Usernames
- Website activity
How HIBP qualifies it
- HIBP verified that the data came from this service.
Source: Have I Been Pwned (CC BY 4.0)
Copied from HIBP 2026-11-05 03:50 UTC