Yahoo Hack Affects 1 Billion Accounts

Security researchers are disturbed that it took Yahoo three years to discover that details on more than 1 billion user accounts had been stolen in 2013.

The breach suggests that someone, possibly a state-sponsored actor, had access to one of the largest email user bases in the world, without anyone knowing. The stolen database may have even included information on emails of US government and military employees.

This incident is distinct from the breach of 500 million accounts the company disclosed on September 22, 2016. Yahoo said in its announcement that how the breach was accomplished is not yet known, and that the company is working with law enforcement to investigate. 

This incident is regarded as being the largest breach on record, in terms of the number of individuals affected. 

People might suppose the breach is unlikely to affect them because the attack happened three years ago and there was no widely reported abuse of the data in the meantime. However, hackers might have targeted users' emails.

Yahoo has also said it is investigating a later, separate issue that might have made some accounts accessible without passwords. "Your email account is the central hub of your entire online existence, if they own that they can ask for password resets on other accounts you have online as well," explains Mr Cluley. Plus, anyone using their account for work purposes, such as sending professional documents back and forth in attachments, could in theory become a target of industrial espionage.

Even if accounts could only be accessed with passwords, the way they were encrypted is less secure than more modern techniques, according to Mr Cluley.

He adds that it is possible the data, including names, telephone numbers and dates of birth, will - or already has - become available to buyers on the dark net, although so far there has been no evidence of this.

Security expert and writer Brian Krebs said in a blog, "For years I have been urging friends and family to migrate off of Yahoo email, mainly because the company appeared to fall far behind its peers in blocking spam and other email-based attacks."

Yahoo has reassured its users: "We continuously enhance our safeguards and systems that detect and prevent unauthorised access to user account."

Some may not think of themselves as Yahoo users but the firm provides some BT and Sky customers' email accounts. "We are urgently investigating this with them," BT said in an online statement, in which it also advised those who had a BT Yahoo email account in August 2013 to reset their password.

Sky said it was advising Sky.com email account users to change their passwords and security question answers. It's also worth remembering that Yahoo acquired Flickr in 2005. Yahoo has said, though, that accounts for Tumblr - which it also owns - would not have been affected.

What should you do?

"Don't just change your Yahoo password," says Mr Cluley. That is the place to start, but once this password is changed, he also recommends changing your password on all other accounts you use and making sure that you use a different one for each.

Security question answers such as "what is your mother's maiden name?" should also be altered. It sounds like a lot of bother, but security experts are increasingly recommending that people use a simple password manager program such as Password Chef, LastPass or 1password.

Two-factor authentication allows users to verify logging in via, for example, entering a separate code sent to their mobile phone.

But the idea that online security stops with password management is outdated, says security expert Prof Alan Woodward at the University of Surrey.

"We're past that now," he says, adding that security professionals tend to enter fake information about themselves to online forms unless they can avoid it. "I'm like the Queen, I have two birthdays - my online birthday and my real birthday," explains Prof Woodward. "Do I give my real address? No - only for financial purposes like billing."

Yahoo accounts do allow users to see recent activity - for example, which computers were used to log in and where in the world they were located. Users can check this for any suspicious behaviour.

If users do want to move away from Yahoo after recent breaches, news site The Parallax recently wrote advice on how to do this.

The deal for mobile giant Verzon to acquire Yahoo for $4.8 billion continues to progress.

BBC:         CyberWire:          ComputerWorld:    More Questions About The Yahoo Breach:


 

« Obama Orders ‘Deep Dive’ Into Election Hacking
Destructive Cyber Attack On Saudi Kingdom »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Fuel Recruitment

Fuel Recruitment

Fuel Recruitment is a specialist recruitment company for the IT, Telecoms, Engineering, Consulting and Marketing industries.

Mega

Mega

Mega is a secure cloud data storage provider with browser-based high-performance end-to-end encryption.

CommuniTake

CommuniTake

CommuniTake builds security, enablement, and management solutions to provide people and organizations with better, and more secure mobile device use.

Perception Point

Perception Point

Perception Point is a Prevention-as-a-Service company, built to enable digital transformation. Our platform offers 360-degree protection against any type of content-based attack.

Veritas Technologies

Veritas Technologies

Veritas provide industry-leading solutions that cover all platforms with backup and recovery, business continuity, software-defined storage and information governance.

Exponential-e

Exponential-e

Exponential-e provide Cloud and Unified Communications services and world-class Managed IT Services including Cybersecurity.

KeyXentic

KeyXentic

KeyXentic Inc. is a professional mobile and data security service provider. We are devoted to design convenient and strong security for user’s data protection and privacy without any compromise.

Cynance

Cynance

Cynance are an award-winning, independent cyber security specialist and part of the Transputec family of companies.

IT Band Systems

IT Band Systems

IT Band Systems is an international provider of IT products and services including web server monitoring and web security consulting.

KanREN

KanREN

KanREN is a member based consortium offering custom, world-class network services and support for researchers, educators, and public service institutions in the state of Kansas.

Celera Networks

Celera Networks

Celera Networks is a managed services provider specializing in cybersecurity, cloud and managed IT services.

Mayer Brown

Mayer Brown

Mayer Brown is a global law firm. We have deep experience in high-stakes litigation and complex transactions across industry sectors including the global financial services industry.

Aardwolf Security

Aardwolf Security

Aardwolf Security specialise in penetration testing to the highest standards set out by OWASP. We ensure complete client satisfaction and aftercare.

Cyber Security Certification Australia (CSCAU)

Cyber Security Certification Australia (CSCAU)

CSCAU is the world’s first 'for mission' industry council set up to address small and medium-sized business (SMB) cyber resilience through annually updated certifiable standards.

Nexsan

Nexsan

Nexsan offers versatile and robust data storage solutions tailored to adapt seamlessly across a diverse range of sectors, ensuring reliable performance for critical data management.

Whiteswan Identity Security

Whiteswan Identity Security

At Whiteswan, we are committed to protecting the digital landscapes of modern enterprises with adaptive, identity-first security solutions that ensure trust, compliance, and resilience.