[Aeolian]

The company disclosed today that it has discovered a breach of more than one billion user accounts that occurred in August 2013. The breach is believed to be separate and distinct from the theft of data from 500 million accounts that Yahoo reported this September.

Troublingly, Yahoo’s chief information security officer Bob Lord says that the company hasn’t been able to determine how the data from the one billion accounts was stolen. “We have not been able to identify the intrusion associated with this theft,” Lord wrote in a post announcing the hack.

“The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers,” Lord added.

Yahoo was alerted to the massive breach by law enforcement and has examined the data with the help of outside forensic experts. The data does not appear to include payment details or plaintext passwords, but it’s still bad news for Yahoo account holders. The hashing algorithm MD5 is no longer considered secure and MD5 hashes can easily be looked up online to discover the passwords they hide.

Yahoo says it is notifying the account holders affected in the breach. Affected users will be required to change their passwords.

Yahoo also announced today that its proprietary code had been accessed by a hacker, who used the code to forge cookies that could be used to access accounts without a password. “The outside forensic experts have identified user accounts for which they believe forged cookies were taken or used. We are notifying the affected account holders, and have invalidated the forged cookies,” Lord said, adding that he believed the attack was launched by a state-sponsored actor.

Today’s revelations add to Yahoo’s long string of security problems. Yahoo employees reportedly knew of the intrusion that led to the theft of data from 500 million users as early as 2014, but the company did not announce the breach until this September. What Yahoo executives knew about the breach, and when they knew it, have been crucial questions in Verizon’s ongoing acquisition of Yahoo. Yahoo did not disclose the first breach until several months after the deal was announced.

Source

[Slacker]

people have beem "hacking" yahoo accounts for as long as i cam remember


they used to be the "ogs" similar to today tjat people targeted (yahoo games andessenger ids"

there has beem FAR more then yahoo actually realizes half of the dumps i filter through for lols are mainly yahoo emails

[Bish0pQ]

The bigger companies never understand ;( I mean we are a forum with like 5% the users of Yahoo, maybe not even that and we still use better encryption algorithms than a multi million dollar company (thanks to @Oni of course).

I'm just surprised why it was saved in MD5 again They keep storing passwords in MD5 which is really bad...
Also surprised that they found out now, not before. Something like that should be immediately known to a company.

[Elf]

Never used Yahoo but lol.

[Aeolian]

Never used Yahoo but lol.

Same here, I've used Hotmail & Gmail.

[mothered]

It took them 3 years to realize the breach? It's mentioned they knew about It earlier, but I don't believe It for a minute. It seems like a coverup to avoid embarrassment.

I can understand smaller corporations (I've compromised heaps, planted backdoors and gained later access many months later, hence It was unnoticed), but a company on Yahoo's scale Is simply appalling.

[Kyzer]

Pretty sure after they denied the first hack, they were secretly digging around internally then figured out, oh shit... we actually got hacked again but it was much larger. I'm surprised they managed to keep it quiet for this long. But the more important question - has anybody actually tried selling the DB anywhere in public, or will it just stay hidden forever.

[mothered]

But the more important question - has anybody actually tried selling the DB anywhere in public, or will it just stay hidden forever.

Precautionary measures would need to be taken with whom It's sold to.

This Is very serious stuff, and If a Fed Is posing as a potential buyer, then that speaks for Itself. I'm sure It'll eventually become public property.

[817_091_278]

This is why I use tutanota as a suitable public email service provider. Otherwise, I'd always opt for Sigaint.

[m0dem]

The bigger companies never understand ;( I mean we are a forum with like 5% the users of Yahoo, maybe not even that and we still use better encryption algorithms than a multi million dollar company (thanks to @Oni of course).

I think we're a little less than 5% of the Yahoo userbase size.