Over 51 Million Records Leaked from Now-Defunct iMesh File Sharing Service

The hacker Peace has put up for sale over 51 million records obtained from the now-defunct iMesh P2P file sharing service.

iMesh was one of the first and most popular file sharing services that appeared, similar to Napster. The service allowed users to share multimedia files with friends via the P2P protocol. The service launched in the late '90s and recently closed down, in May 2016.

LeakedSource, a company that specializes in collecting user data from publicly available data breaches, has announced today that it came into the possession of data from the iMesh service.

The same data is also available for sale on The Real Deal Dark Web marketplace. The hacker who's selling it is the same person who also put up for sale details from LinkedIn, Tumblr, Twitter, and MySpace.

In his listing, the hacker is asking for 0.5 Bitcoin (~$335) for the entire dataset. After analyzing the data, LeakedSource says Peace is in possession of 51,310,759 iMesh records.

Hacker's listing on the Dark Web

iMesh was probably hacked on September 22, 2013

Based on the latest timestamp, LeakedSource estimates the hacker(s) breached iMesh on September 22, 2013. For each record, LeakedSource claims there are an email address, a username, a password, an IP address, and location information (country).

According to LeakedSource's analysis, most of iMesh's users were from the US (13.7 million), most of them signed up with Hotmail (14.3 million) and Yahoo (10.5 million) email addresses, and almost one million used 123456 as their password.

The service stored all passwords in a simple format, which is easy to break. Passwords were salted, then passed through an MD5 algorithm, salted again, and passed through MD5 again.

Below is an analysis of the leaked data. LeakedSource has ranked the most common passwords, the most common email address domains, users by location, and has categorized users by the year they joined the iMesh service.