LinkedIn Feature Exposes Email Addresses
Summary: Researchers at Rhino Security Labs showed that LinkedIn's contact-import feature reveals which email addresses in an uploaded contact list do not belong to LinkedIn users, letting them deduce a target's address by comparing that list against their own guesses. Using an Excel macro to generate several hundred name-based address permutations, the duo located the webmail address Mark Cuban used for LinkedIn, and Bryan Seely said the method worked about nine times out of ten on other celebrities.
What's compelling: LinkedIn's own information security director, Cory Scott, said email address-to-user mapping is a common design pattern and that the company relies on rate limiting, scoring and abuse detection to stop frequent abusers - while the researchers' success rate against public figures was roughly 90 percent, and the same addresses feed spear-phishing and stalking.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026