Details including names, passwords, email addresses, phone numbers and security questions were taken from the company’s network in late 2014

This article is more than 4 years old

This article is more than 4 years old

Hackers stole the personal data associated with at least 500m Yahoo accounts, the Sunnyvale, California-based company confirmed on Thursday.



Yahoo hack: what to do to protect your account Read more

Details including names, passwords, email addresses, phone numbers and security questions were taken from the company’s network in late 2014 by what was believed to be a state-sponsored hacking group.

The company is investigating the breach with law enforcement but currently believes that credit card or bank details were not included in the stolen data.

“The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation has found to be affected,” said the company in a statement.

Nevertheless, the news may jeopardise the $4.8bn sale of Yahoo’s core business to Verizon, announced in July. Verizon told the BBC it had only learned of the hack “within the last two days” adding it had “limited information”.

Cyberwar is not coming to the US – it’s already here Read more

Yahoo is notifying users who may have been affected and says that anyone who has not changed their Yahoo passwords since 2014 should do so. The company has also invalidated affected users’ security questions so that they can’t be used to access accounts.

“Yahoo encourages users to review their online accounts for suspicious activity and to change their password and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account,” said the company.

Users should be very wary of any emails purporting to come from Yahoo, particularly if they prompt the users to click any links, download any attachments or give out any personal information.

Yahoo announced it was investigating a data breach earlier this summer but at the time thought just 200m user accounts were affected.

“Yahoo may very well be facing an existential crisis,” said Corey Williams, from identity management software company Centrify. “Already besieged by business execution issues and enduring a fire sale to Verizon, this may be the straw that breaks the camel’s back.”

US Senator Mark Warner, who has worked in the technology industry and often speaks on tech issues, described the seriousness of the breach as “huge”.

“While its scale puts it among the largest on record, I am perhaps most troubled by news that this breach occurred in 2014, and yet the public is only learning details of it today,” he said, urging Congress to create a data breach notification standard to ensure consumers find out sooner if their data has been compromised.

Security researcher Kurt Baumgartner from Kaspersky Lab also criticised Yahoo for its slow response to the attack but said it was not unexpected. “It’s unfortunate that when we are talking about this organization, a massive breach doesn’t come as a big surprise,” he said.

“The company has demonstrated that it isn’t quick to implement best practices and available security technologies, such as the delay in encrypting IM communications, implementing https for its web properties and more. These types of breaches highlight why all companies, need to be cybersecurity leaders, not followers.”