“HACKED! What you need to know about the Yahoo data breach”

On Thursday, September 22, 2016, Yahoo publicized a 2014 data breach “associated with at least 500 million user accounts.”[1]  This may be the largest data breach ever, in terms of those affected.[2]  Experts believe it could have a ripple effect online for years to come.[3]

What type of information may have been compromised?

• Names;
• Email addresses;
• Dates of birth; and
• Encrypted or unencrypted security questions and answers (in some cases).[4]

Who is responsible for the breach?

• Yahoo believes that a “state-sponsored actor” is to blame; someone acting on behalf of a government.[5]
• The FBI is investigating the breach, and one of the major “cyber-threats” to the U.S., i.e. China or Russia, are suspects.[6]

How long has Yahoo known about this?

• There were reports of a breach in August 2016, when a hacker was purportedly selling data from 200 million Yahoo users on the dark web. The hacker is named “Peace,” and has previously been linked to the sale of stolen accounts from social media sites MySpace and LinkedIn.[7]

What should one do if he or she has a Yahoo Account?

• Yahoo has published an “Account Security Issue FAQs” page[8] to help inform and guide users through this security breach.
• Other steps that users can take immediately[9]:
  • “Change passwords and security questions”; and
  • “Review non-Yahoo accounts” for suspicious activity.
• Other steps that can be taken to secure online accounts, in general[10]:
  • “Change passwords often”;
  • “Never use the same password twice”;
  • “Pick better passwords”;
  • “Use a password manager”;
  • “Update security questions”;
  • “Be alert”;
  • “Turn on two-factor authentication”.

As potentially the largest data breach in history, there will be much more to report on this topic in the coming weeks, months, and years. This will not only affect Yahoo’s users, but the company itself, as it is in the middle of a billion dollar acquisition deal with Verizon.[11]  In July 2016, Verizon announced that it would purchase Yahoo’s core properties for $4.38 billion.[12]  This deal was originally slated to close in the first quarter of 2017.[13]

[1] http://money.cnn.com/2016/09/22/technology/yahoo-data-breach/index.html

[2] Id.

[3] http://money.cnn.com/2016/09/22/technology/yahoo-hack-scale/index.html

[4] http://www.usatoday.com/story/tech/2016/09/22/report-yahoo-may-confirm-massive-data-breach/90824934/

[5] http://money.cnn.com/2016/09/22/technology/yahoo-data-breach/index.html

[6] http://theusbport.com/massive-yahoo-hack-leaves-data-500-million-accounts-vulnerable/17126

[7] http://www.usatoday.com/story/tech/2016/09/22/report-yahoo-may-confirm-massive-data-breach/90824934/

[8] https://help.yahoo.com/kb/account/SLN27925.html?impressions=true

[9] http://www.usatoday.com/story/tech/news/2016/09/22/yahoo-breach-500-million-what-to-do/90849498/

[10] http://money.cnn.com/2016/09/22/technology/yahoo-hack-password-tips/index.html?iid=SF_LN

[11] http://money.cnn.com/2016/09/22/technology/verizon-yahoo-data-breach/index.html

[12] Id.

 [13] Id.