Yahoo Discloses Hack of 1bn Accounts in Second Huge Data Breach
- Thursday, December 15th, 2016
- Share this article:
Yahoo now holds the record for the two biggest data breaches in history, after it disclosed information regarding yet another massive breach of data, in August 2013, in which over 1bn accounts were compromised.
This follows the companys disclosure in September that 500m accounts had been compromised in late 2014.
The massive data breach occurred and is believed to be separate from the other significant breach of data – but Yahoo has not been able to pinpoint the intrusion associated with the theft.
In a post, Yahoo’s chief information security officer Bob Lord said: “The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers.
“The investigation indicates that the stolen information did not include passwords in clear text, payment card data, or bank account information. Payment card data and bank account information are not stored in the system the company believes was affected.”
Yahoo also revealed that an unauthorised third-party had accessed its proprietary code to learn how to forge cookies – believing this breach to be connected to the ‘same state-sponsored actor believed to be responsible for the data theft the company disclosed’ in September.
“We are notifying potentially affected users and have taken steps to secure their accounts, including requiring users to change their passwords. We have also invalidated unencrypted security questions and answers,” Lord added. “We invalidated the forged cookies and hardened our systems to secure them against similar attacks.”
News of the breach will bring the Verizon takeover of Yahoo into question. The $4.8bn (£3.7bn) deal, announced in July, is yet to close. It was rumoured in October that Verizon was looking for a $1bn discount on the deal, amid Yahoo’s revelation of the first breach.
Separately, it was reported in October that Yahoo had helped the US government to scan ‘hundreds of millions’ of emails.