Bought for Its Data — And Then the Password Leak

2016 gave MySpace two headlines. One was a sale. The other was one of the largest password breaches ever disclosed.

Time Inc. buys Viant

In February 2016, Time Inc. — the magazine publisher behind *Time*, *People*, *Sports Illustrated* and *Fortune* — acquired Viant, the advertising technology company that owned MySpace. Trade coverage, including Variety's, framed it plainly: a legacy publisher buying an ad-tech platform primarily for its registered-user identity graph, with MySpace attached.

The reported logic was targeting. Time Inc. had enormous audiences and weak first-party data. Viant had a large base of registered, logged-in users — MySpace's decade of accounts foremost among them — that could be matched against advertising inventory.

So MySpace was, for the second time, acquired by a print-first media company that wanted its audience data. The first time, in 2005, it cost $580 million and the platform was the point. This time it came bundled inside an ad-tech deal and the platform was the paperwork.

The breach

On May 31, 2016, MySpace disclosed a security incident: email addresses, usernames and passwords for accounts created prior to June 11, 2013 — the old platform, before the relaunch — had been stolen and were being offered for sale. Reporting put the figure in the region of 360 million accounts, making it among the largest credential exposures publicly known at that point.

The data was old. The passwords were protected with SHA-1 without salting, a scheme already considered inadequate by the time of the breach. MySpace invalidated affected passwords, notified users, and worked with law enforcement.

Analysis: the breach is usually reported as a MySpace failure, and operationally it was. Structurally it is a warning about what happens to abandoned accounts everywhere. Nobody in that dataset had used their password in years — which is exactly why it was dangerous, because a meaningful share of those people had reused it somewhere they still logged into. Dormant accounts are not inert. They are unmonitored liabilities that accumulate value to attackers over time, and every platform that has ever promised to preserve your past is holding the same bomb. MySpace's fifteen years of custodianship, the thing I have praised elsewhere in this series, is also the thing that made this breach so large.

What it felt like

Like getting a letter about a house you moved out of a decade ago, informing you it has burned down. Most people affected had to be reminded they had an account at all. A smaller number spent an unpleasant afternoon changing a password they had reused across their whole adult life.

The people

Tim Vanderhook remained CEO of Viant, now inside Time Inc. The Vanderhooks stayed operationally in charge of the property throughout. Time Inc.'s own position was deteriorating; within two years it would itself be acquired, taking MySpace along in the next transaction.

Why this matters in 2026

Any relaunch will inherit this history, and the archive it wants to reopen is the same archive that leaked. Custody of a generation's early internet identity is a genuine asset and a genuine hazard, and 2016 is the year those two facts arrived in the same twelve months.

The relaunch pitch — a return to something warmer and less algorithmic — will eventually have to answer the unglamorous question this year raises: who is responsible for three hundred and sixty million people's teenage passwords?