Kim Hjelmgaard and Elizabeth Weise report:
Information from at least 500 million Yahoo accounts was stolen from the company in 2014 and the company believes that a state-sponsored actor was behind the hack.
The information may have included names, email addresses, telephone numbers, dates of birth, and, in some cases, encrypted or unencrypted security questions and answers, Yahoo said.
Claims surfaced in early August that a hacker using the name “Peace” was trying to sell the usernames, passwords and dates of birth of Yahoo account users on the dark web — a black market of thousands of secret websites.
Read more on USA Today.
So we now have a new “biggest breach ever” winner… ding!ding!ding!
I will admit I am a bit surprised by the number. While all the media outlets covering the news today generally point out how “Peace” had first approached the media with news of the hack a few months ago, the truth is that before Peace ever approached the media, I had heard word that Yahoo had been hacked, but the word was that it was about 180 million give or take. In other words, I wasn’t surprised to subsequently hear that Peace and other vendors were shopping a database that supposedly had 200 million records. Nor was I surprised to hear from other sources that some of the databases being shopped were not from any hack of Yahoo, but were data pulled in from other hacks of other entities.
So now Yahoo is saying 500 million, and that it was 2014 and a state actor? I’d like to know how they figure it’s a state actor, and how they know the difference between some actors who have done very big hacks but are not state actors.
Here is Yahoo!’s statement:
An Important Message to Yahoo Users on Security
September 22, 2016 02:28 PM Eastern Daylight Time
SUNNYVALE, Calif.–(BUSINESS WIRE)–A recent investigation by Yahoo! Inc. (NASDAQ:YHOO) has confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by what it believes is a state-sponsored actor. The account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers. The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation has found to be affected. Based on the ongoing investigation, Yahoo believes that information associated with at least 500 million user accounts was stolen and the investigation has found no evidence that the state-sponsored actor is currently in Yahoo’s network. Yahoo is working closely with law enforcement on this matter.
Yahoo is notifying potentially affected users and has taken steps to secure their accounts. These steps include invalidating unencrypted security questions and answers so that they cannot be used to access an account and asking potentially affected users to change their passwords. Yahoo is also recommending that users who haven’t changed their passwords since 2014 do so.
Yahoo encourages users to review their online accounts for suspicious activity and to change their password and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account. The company further recommends that users avoid clicking on links or downloading attachments from suspicious emails and that they be cautious of unsolicited communications that ask for personal information. Additionally, Yahoo asks users to consider using Yahoo Account Key, a simple authentication tool that eliminates the need to use a password altogether.
Online intrusions and thefts by state-sponsored actors have become increasingly common across the technology industry. Yahoo and other companies have launched programs to detect and notify users when a company strongly suspects that a state-sponsored actor has targeted an account. Since the inception of Yahoo’s program in December 2015, independent of the recent investigation, approximately 10,000 users have received such a notice.
Additional information will be available on the Yahoo Security Issue FAQs page, https://yahoo.com/security-update, beginning at 11:30 am Pacific Daylight Time (PDT) on September 22, 2016.
About Yahoo
Yahoo is a guide to digital information discovery, focused on informing, connecting, and entertaining through its search, communications, and digital content products. By creating highly personalized experiences, Yahoo helps users discover the information that matters most to them around the world — on mobile or desktop. Yahoo connects advertisers with target audiences through a streamlined advertising technology stack that combines the power of Yahoo’s data, content, and technology. Yahoo is headquartered in Sunnyvale, California, and has offices located throughout the Americas, Asia Pacific (APAC) and the Europe, Middle East and Africa (EMEA) regions. For more information, visit the pressroom (pressroom.yahoo.net) or the Company’s blog (yahoo.tumblr.com).
Statements in this press release regarding the findings of Yahoo’s ongoing investigation involve potential risks and uncertainties. The final conclusions of the investigation may differ from the findings to date due to various factors including, but not limited to, the discovery of new or additional information and other developments that may arise during the course of the investigation. More information about potential risks and uncertainties of security breaches that could affect the Company’s business and financial results is included under the caption “Risk Factors” in the Company’s Quarterly Report on Form 10-Q for the quarter ended June 30, 2016, which is on file with the SEC and available on the SEC’s website at www.sec.gov.
Yahoo!, the Yahoo family of marks, and the associated logos are trademarks and/or registered trademarks of Yahoo! Inc. Other names are trademarks and/or registered trademarks of their respective owners.
“So now Yahoo is saying 500 million, and that it was 2014 and a state actor? I’d like to know how they figure it’s a state actor, and how they know the difference between some actors who have done very big hacks but are not state actors.”
Isn’t that a trend that has been going on for a little while now? I’ve noticed it, and have been noticing it more and more. Especially from larger companies.
It’s perhaps embarrassing for large companies to say a 16 year old kid hacked all our accounts. It makes their security look awful. But bring in the word “State Actor” and, ooooh, aaaah. Spy versus spy stuff with top secret exploits and unlimited funds to specifically target a company.
At least, that is my line of thinking. I just see too many of these “state actor” excuses now. It has become the norm and a new scapegoat attempt.
We need to take bets.
5$ (Canadian) says China will be named as the state actor. It almost always is, as is the trend. American money will be taken at par. TY.
😉
Place your bets!
Why are we finding out about this 2 years later????????????????
Because no hacker called them in 2014 and said, “Ha, ha, we’ve got your data!” ?
Because they didn’t do a deep investigation until someone contacted them in 2016 about mostly fake data that they had to investigate?
Because there are generally lame consequences for companies that neither prevent breaches nor discover them on their own promptly?
How many guesses do I get?