critical severity July 01, 2008 · 3 min read

MySpace — 360 Million Accounts, and the Weakest Password Storage of Any Major Breach (2008)

If you have an account with MySpace, here’s what’s now in circulation.

MySpace stored the SHA-1 hash of only the first ten characters of your password, lowercased, with no salt. That is not a weakened hash — it is close to no hash at all. The data sat unseen for about eight years before surfacing for sale in 2016.

A truncated password hash illustrating lost characters

What happened

Around 2008, MySpace lost 359,420,698 accounts. Nothing visible happened for roughly eight years. In May 2016 the data was offered for sale on the dark-market site The Real Deal by a seller using the name Peace — the same handle behind the LinkedIn listing that surfaced in the same wave. The breach-notification service LeakedSource reported receiving a copy containing just over 360 million accounts.

Caught in this breach?

You can’t unleak a breach. You can take away what it’s worth.

Deep Sweep shows you every leak tied to you and exactly what to change. Then it strips your name, address and family off the look-up sites that turn a leaked record into somebody knocking on your door — $29 one-time, includes 30 days of Protection. We write to 582 companies. No subscription to start.

Scan free, then Deep Sweep — $29 →

Not ready yet? Run a free breach check on this email

We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.

The exact breach date is unknown. HIBP dates it to approximately 2008 based on analysis of the data itself.

The password storage, specifically

This is the fact worth carrying away, and it is worse than the usual summary suggests. MySpace stored a SHA-1 hash of the first ten characters of the password, converted to lowercase, with no salt. Three separate failures compound here:

Truncation to ten characters destroys the benefit of a long password. A twenty-eight character passphrase was protected exactly as well as its first ten characters. Lowercasing collapses the alphabet, so capitalisation contributed nothing. No salt means every account that chose the same password produced the same hash, so cracking is done once across the entire set rather than once per user.

The practical effect is that essentially every password in this dataset should be treated as known. Unlike bcrypt or PBKDF2 breaches, where a strong password still protects you, there is no password strength that survived this scheme.

Why a breach from 2008 is still live

The obvious objection is that nobody has used their MySpace password in fifteen years. The risk was never the MySpace account — it is that the recovered password is a real password you chose, paired with a real email address you probably still use.

People rarely invent passwords from scratch. They iterate. A password recovered from this dump is a strong hint at the structure of passwords you have used since: the same base word, the same substitutions, a different number on the end. That is precisely what credential-stuffing tools generate variants from.

The email-to-username mapping is the other durable half. Handles migrate across platforms; a MySpace username from 2008 that still matches your handle today is a direct link between a fifteen-year-old identity and a current one.

The identity-chain implication

Old social-network breaches are unusually good starting points for doxxing precisely because they predate the habit of separating personas. People registered in 2007 under their real name, with their school, their home town and their actual friends attached, long before anyone thought of that as a risk.

An attacker who links a current gaming handle back to a MySpace-era account often gets the real name and home town for free, from a decision made by a teenager who is now an adult with an entirely different threat model.

What to do now

Treat this as an exposure of a password pattern, not of one account.

What You Should Do

Retire the password family, not just the password — if anything you use today shares a base word with your MySpace-era password, change it
Prioritise any account still using the email address that was registered to MySpace, since that pairing is what stuffing tools try first
Check whether your old MySpace username still matches a handle you use publicly — that link is often the whole doxxing chain
Turn on 2FA everywhere that email address is the recovery address
Use a password manager so that no future breach can reveal the structure of your other passwords

What the free scan actually returns

Sample resultyou@email.comIllustrative — not a real person

Found on people-search siteswe remove these

These listings are live, public, and legal to remove. That’s what a Deep Sweep buys.

value redacted in this sampleage, relatives, address historySpokeo

value redacted in this samplephone, household, property recordsBeenVerified

value redacted in this sample582 companies checked

Found in breach recordsverifiedreported — unverified

Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.

verifiedvalue redacted in this samplepassword + phone · 2024telecom breach

unverifiedvalue redacted in this sampleclaimed in ransomware listing · 2026leak-site claim

Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.

Were you a MySpace customer?

MySpace is one breach. Your email is probably in others.

359.4M accounts accounts were exposed here. Check whether yours is one — and find every other leak tied to the same address, in about 15 seconds. No account, no card.

Report details & sourcing

Severity Critical

Disclosed July 01, 2008

Last reviewed July 22, 2026

Affected 359.4M accounts

Data exposed Email addressesUsernamesPasswords

By GalaxyWarden Threat Research · Editorial & sourcing standards

Editorial & sourcing policy

GalaxyWarden is a breach-monitoring service and news aggregator. We do not exfiltrate, host, purchase, or redistribute stolen data. Breach information is compiled from publicly accessible sources and threat-intelligence platforms, and is reported as claims attributed to their source. We promptly correct or remove material shown to be inaccurate — see our content & takedown policy or write to support@galaxywarden.com.

Sources: Have I Been Pwned — MySpace breach entry · Vice — the hacker allegedly behind the LinkedIn and MySpace megabreaches

Related breaches

critical October 04, 2013