Music analytics site Last.fm had a user credential breach in 2012, the details of which are just now becoming public.