What amazes me the most, is that they likely new passwords were probably compromised way back in 2012, and might have suspected it was a far worse compromise, b

What amazes me the most, is that they likely new passwords were probably compromised way back in 2012, and might have suspected it was a far worse compromise, but only forced the password reset for most users now, after they leaked. "Durzy said it was not yet determined whether the email addresses that corresponded to the hacked passwords were also stolen." - http://gadgets.ndtv.com/social-networking/news/fbi-to-help-linkedin-on-password-theft-228800 http://gadgets.ndtv.com/social-networking/news/fbi-to-help-l... Why would they think/assume only the passwords were compromised and not all of the associated email addresses?! Why did they assume only the number of leaked passwords were the number originally stolen? The only reason why the millions upon millions of unsalted SHA1 password hashes leaked now, is likely because they stopped being useful for attackers. People working in the incident response space know: the 2012 breach quickly resulted in hundreds of follow-up breaches, some of them known, some of them not public. How? Likely from shared passwords due to the linkedin breach, also likely why linkedin was targeted in the first place... as a precursor for follow-up attacks targeting Google apps accounts and VPNs without 2FA (which leads to more passwords, and repeat.)