LiveJournal Data Breach (2017): What Was Exposed & What To Do

In mid-2019 reports surfaced of an alleged data breach affecting LiveJournal that dated back to 2017. The incident involved approximately 26.4 million records containing usernames, email addresses and passwords stored in plain text. An archive of the data appeared on a hacking forum in May 2020 and was later redistributed. The breach came to wider attention after credential abuse was observed against Dreamwidth, a platform that shares a substantial user overlap with LiveJournal. Confirmation that the usernames and email addresses matched existing LiveJournal accounts supported the claim that the data originated from that service.

Inside the incident

Public information states that the breach occurred in 2017, though the precise date, method of intrusion and duration of unauthorised access remain undisclosed. The reported scale is 26.4 million unique records. The data types listed are usernames, email addresses and passwords stored without additional protection.

News of the incident emerged in mid-2019 following reports of credential abuse on Dreamwidth beginning in 2018. An archive containing the material was posted to a popular hacking forum in May 2020. No official statement from LiveJournal detailing the circumstances of the event has been referenced in available reporting.

How a breach like this happens

Incidents involving the exposure of usernames, email addresses and passwords commonly begin with unauthorised access to an organisation’s user database. Attackers may obtain entry through compromised credentials on other sites, vulnerabilities in web applications or misconfigured servers that leave data accessible.

Once inside, an attacker can copy the authentication tables. When passwords are stored in plain text rather than hashed, the entire set becomes immediately usable for further attempts against the same accounts or similar services. The material may then be retained privately or later offered on forums where credential lists circulate.

LiveJournal and its sector

LiveJournal operates as an online journaling and blogging platform that has maintained a user base since the late 1990s. Services of this type store account credentials, contact information and, in many cases, personal writing that users have chosen to publish under their accounts.

A breach at such a platform is consequential because the service holds long-standing accounts whose passwords may still be reused elsewhere. The crossover with Dreamwidth noted in reporting illustrates how user communities can extend the reach of any exposed credentials beyond the original site.

What data was at risk

The facts name three categories of information: usernames, email addresses and passwords stored in plain text. The presence of 26.4 million unique records has been reported, with usernames and email addresses verified against existing LiveJournal accounts.

Organisations in this sector routinely hold additional profile details such as display names, registration dates and sometimes secondary contact information. Whether any further categories were included in the 2017 incident has not been confirmed in public reporting.

Why it matters

Plain-text passwords allow direct attempts to access the original accounts or any other services where the same credentials were used. Email addresses provide a reliable identifier for targeted follow-on activity such as phishing.

For the organisation, the incident highlights the long-term consequences of retaining authentication data in an unprotected form. For individuals, the primary concern is the potential for continued misuse of credentials that may remain valid years after the original event.

Were you affected?

Individuals can check whether their email address appears in known breach records by using a free exposure scanning service. If matches are found, the recommended first step is to change the password on the affected account and on any other service where the same password was used.

Enabling two-factor authentication where available adds a further control that reduces the value of a leaked password alone. Monitoring for unusual login attempts on long-unused accounts is also advisable given the age of the reported data.

AICompiled with AI assistance from public sources and published under our editorial standards.