LinkedIn is facing a class action suit over the security breach that saw millions of users’ passwords posted online.
Illinois resident Katie Szpyrka leads the complaint, which alleges that LinkedIn failed to “properly safeguard its users’ personally identifiable information”.
The complaint filed in California accuses the business network of using a “weak encryption format” for users’ information and not having crucial security measures in place.
A LinkedIn spokesperson told The Register that the class action suit’s claims were “without merit”.
“No member account has been breached as a result of the incident, and we have no reason to believe that any LinkedIn member has been injured,” the company said. “Therefore, it appears that these threats are driven by lawyers looking to take advantage of the situation.
“We believe these claims are without merit, and we will defend the company vigorously against suits trying to leverage third-party criminal behaviour.”
“Despite its contractual obligation to use best practices in storing user data, LinkedIn failed to utilise basic industry standard encryption methods. In particular, LinkedIn failed to adequately protect user data because it stored passwords in unsalted SHA1 hashed format,” the filing said, branding SHA1 “outdated”.
The case also latches on to reports that LinkedIn was hacked through an SQL injection attack, which uses weaknesses in a company’s website to get into its back-end systems.
“If true, LinkedIn’s failure to adequately protect its website against SQL injection attacks – in conjunction with improperly securing its users’ personally identifiable information – would demonstrate that the company employed a troubling lack of security measures,” the complaint said.
Naturally, the class action suit is looking for attorney fees and damages for US members of LinkedIn.