Received an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?

Question

I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised emails, and passwords.

Etsy says they themselves aren't compromised, but apparently you can use a linkedin account to access Etsy.

So I'm curious.

1. How big of a deal was the Linkedin breach?? I'm assuming everything was protected so that our passwords were not plain text, but I guess it's a matter of time before they are cracked (I'm assuming LinkedIn uses very good security).

2. From what I see they "Invalidated" passwords before 2012... but what about after?

3. Did Etsy actually do a mass password reset, or is this a spam/phishing email trying to take advantage of what happened with Linkedin, or take advantage of us not knowing that Linkedin was/wasn't compromised?

4. If both passwords were reset internally(Linkedin "Invalidated some passwords), is there any reason to reset the passwords if we don't need to use those services? I'm not sure how good their "random passwords" for resetting are, but if they are good enough can we just not change the passwords, or is it ALWAYS a best practice to change the passwords?

^ I'm just wondering if there might be greater risk (phishing attempt) if you do try to click those password reset links(since I'm assuming they aren't emailing us our passwords), and that those could be malicious? Again, assuming the fact that you do NOT use those accounts often. If you do use them often, or that we SHOULD reset the passwords again... what steps should we take then? Contact both companies to make sure it was a legit breach and that my email to Etsy was legit?

EDIT:

another question came to me..

Would it be wise for everyone to change their passwords across the board then? If the data has been cracked, then people should change their passwords (for those who were compromised back then, probably already changed their passwords I'm assuming though)?

Answer 1

The email is referring to a breach of the LinkedIn password database that happened back in 2012. This was one of several HUGE breaches that was discovered around the end of May 2016, all of which actually happened earlier.

Although we knew about the LinkedIn breach a few years ago, we thought it was only a case of "some passwords were stolen". 6 million account owners were apparently notified at the time.

Then somebody put the full dataset for sale on the darkweb in 2016. And we learned the true scope was "all the passwords got stolen".

After these breaches, there are now over 600 million valid username/password combinations for sale, for a few very popular sites including LinkedIn, MySpace, and Tumblr.

Knowing that the majority of Internet users re-use passwords, smart criminals bought up those stolen credentials and started trying to log into various other online services, including github, Twitter, Pinterest, Instagram, TeamViewer, GoToMyPC, and almost certainly others. So no, I doubt very much "you can use a LinkedIn account to access Etsy", however if you (like most people on the Internet) used the same password on Etsy as you used on LinkedIn, somebody probably used the password they stole from LinkedIn to try logging into your Etsy.

So: if you've EVER had a LinkedIn account, or a MySpace account, it's probably a good idea to change your password there. If you ever re-used that password anywhere else, change it there too. To be safest, you're right not to follow the link in the email. Go directly to each site, and change it there through the normal means, rather than following the email link.

While you're at it, consider getting a password manager like KeePass, 1Password, DashLane, LastPass, or similar; this will allow you to come up with a unique and strong password everywhere, without needing to remember all of them. Then when something like this inevitably happens again, you only need to change the one password that got breached.

If you're curious (or want to have a warning next time), take a minute to search for and/or register your email address over at Troy Hunt's haveibeenpwned service, which can tell you if your credentials were leaked in any of the fairly large collection of breaches he had access to.

Answer 2

If you use the same password for other websites it definitely leaves you vulnerable. I'm not sure if it's a phishing attempt, however if you've started to form a pattern for repetitive password use it may be the smartest move to change to something new.