A recent investigation by Yahoo! Inc. has confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by what it believes is a state-sponsored actor.
MacDailyNews Take: A “recent” investigation, 24 months after the fact.
The account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers. The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation has found to be affected.
Based on the ongoing investigation, Yahoo believes that information associated with at least 500 million user accounts was stolen and the investigation has found no evidence that the state-sponsored actor is currently in Yahoo’s network. Yahoo is working closely with law enforcement on this matter.
Yahoo encourages users to review their online accounts for suspicious activity and to change their password and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account. The company further recommends that users avoid clicking on links or downloading attachments from suspicious emails and that they be cautious of unsolicited communications that ask for personal information. Additionally, Yahoo asks users to consider using Yahoo Account Key, a simple authentication tool that eliminates the need to use a password altogether.
Online intrusions and thefts by state-sponsored actors have become increasingly common across the technology industry. Yahoo and other companies have launched programs to detect and notify users when a company strongly suspects that a state-sponsored actor has targeted an account. Since the inception of Yahoo’s program in December 2015, independent of the recent investigation, approximately 10,000 users have received such a notice.
Additional information will be available on the Yahoo Security Issue FAQs page, https://yahoo.com/security-update, beginning at 11:30 am Pacific Daylight Time (PDT) on September 22, 2016.
Source: Yahoo! Inc.
MacDailyNews Take: Yahoos.
SEE ALSO:
Yahoo expected to confirm massive data breach, impacting several hundreds of millions of users – September 22, 2016
Remind me again, who is this Yahoo? Maybe I should look it up on AOL.
Who? It is a loser of 500 million user accounts.
How does someone siphon off half a billion of digital records without anyone noticing? That has to be one massive file.
Curiously enough, the stock market doesn’t seem to care that much. After being up by about 1%, the stock took a dip below yesterday’s close (by about 2%), only to recover back and then bounce a bit. Much more significant movement happen when it slightly under-performs on a quarterly report…
It was a garbage file on a Gibson server and the password was “God”.
Explains maybe why my bank started making me answer my security questions for every visit a few weeks ago.
If I could find a great email alternative to Yahoo or Gmail, I’d take it. But who can you trust?
Trust yourself. Make your own mail server.
That’s what she (Clinton) said!
MaxBay@icloud.com, or did I miss a subtle /s? And probably not a good idea to set your password as “admin” or “1234”.
Google mail should not be lumped in with yahoo mail. Google is a much better company with much better security in my opinion. Their spam filtering is also vastly superior to yahoo.
You’re here to defend Google? Seriously? Congratulations! You have officially won the Internet idiot of the year award.
If you’re using Google services you should know that:
— When you perform a search using Google, the text string of your query as well as the URLs you subsequently click are recorded. All of them. Every. Single. Time. Since the late 90s.
— If you have any non-Gmail email account (including your own domain-based email account), are you aware what happens when you reply to anyone who sends an email message to you from their Gmail account? That’s right, the text in the originating message as well as the text in YOUR message are auto-scanned and keyword-analyzed upon passing through the Gmail servers. The results are added to your Google profile that is indexed under your own email address, and then utilized for ad profiling and and any other marketing purposes they see fit to use.
— Contacts stored in a Gmail account are used for profiling and association with other Google-indexed accounts (including non-Gmail accounts).
— The videos you watch on YouTube are also added to your profile.
— The photos you upload to Google Photos absolutely do have facial recognition applied, with the results being cross-referenced with your Google profile and other Google profiles. In other words, they know who you know.
— Let’s be clear: Even if you don’t have a Gmail account, you have a Google profile from using Google search, watching YouTube, or exchanging an email with someone who uses a Gmail account. And this is linked with every single website you visit that has ads, because those are served and tracked by a variety of Google ad services such as Double-click, etc.
— All of this information is retained forever by Google.
None of this is paranoid conspiracy theory; it’s simply the way Google does business. And the overwhelming majority of people worldwide seem to have gladly accepted it.
Why not try an Apple mail/icloud address while using suggested password. I have had a mac.com address for years and never ever had a problem. Use Apple keychain suggested password system too. Very good and helpful
Yahoo totally sucks. I stopped using it about 100 years ago. Move on.
“100 years”
Ahhh, the regular drama, hyperbole and misinformation.
Yahoo Mail is great, user here for a 100 years. 😏
Is this why I get GSX phishing emails to my
Yahoo account?
I changed my password many times since 2014. So I am interested if my account was a part of the breach. I will be deleting the account anyway. So sad.
State-sponsored actors. That would be the NSA I believe.
Sounds like it was a serious issue 4 years ago and now it’s just a historical footnote. Ha.
I dunno what Marissa has to do with this story, but she’s still such a fox that I hardly mind a gratuitous glam (non-work wear) shot….
Yahoo was the email provider for the Verizon.net domain until a recent shift to AOL. Does anybody know if all of us who had DSL via Verizon landlines in 2014 are part of this?
What a set of dumbasses. That is why I doubt anyone’s data is safe. Like the head of the FBI said; There are two types of people walking around the U.S.A. those know they have been hacked by the Chinese and those who don’t.
OK, so they have admitted that 500 million accounts have been compromised. Just how many Yahooo accounts were unaffected? Could it be that every account at that time was affected?
nice site.