Six Democratic US senators on Tuesday said it was “unacceptable” that Yahoo only last week announced a 2014 hack into 500m user accounts and asked embattled CEO Marissa Mayer for more information about the company’s investigation into the data breach.

The lawmakers said they were “disturbed” the two-year-old intrusion was detected so long after the hack occurred. “Millions of Americans’ data may have been compromised for two years,” the senators wrote in a joint letter addressed to Mayer. “This is unacceptable.”

Yahoo did not immediately respond to a request for comment about the letter.



Yahoo has faced mounting questions about exactly when it knew about the 2014 cyber-attack that exposed the email credentials of users, a critical issue for the company as it seeks to prevent the breach from affecting a pending takeover of its core business by Verizon.



The internet company has said it detected the breach this summer after conducting a security review prompted by an unrelated hack claim that turned out to be meritless. Yahoo has not given a precise timeline explaining when it was made aware of the 2014 attack, or if it knew of the breach before announcing the deal with Verizon in late July.

The senators requested a briefing from Yahoo to explain the company’s investigation into the breach, its cooperation with law enforcement and national security authorities, and plans to protect affected users. The letter was signed by senators Patrick Leahy, Al Franken, Elizabeth Warren, Richard Blumenthal, Ron Wyden and Edward Markey.



The senators asked Mayer for a timeline of the hack and its discovery and how such a large breach went undetected for so long. They also asked what Yahoo was doing to prevent another breach in the future, if the company had changed its security protocols, and whether the US government had warned of a possible hacking attempt.



The letter came a day after Democratic senator Mark Warner asked the US Securities and Exchange Commission to investigate whether Yahoo and its senior executives fulfilled obligations to inform investors and the public about the hacking attack, which Yahoo has blamed on a “state-sponsored actor”.

Meanwhile, security experts have warned that data released by the breach could be used by criminals using a technique known as “credential stuffing”, in which leaked username and password combinations are used on a series of websites in an effort to break in. Software makes the trial-and-error process practically instantaneous.

Credential stuffing typically succeeds between 0.1% to 2% of the time, according to Shuman Ghosemajumder, the chief technology officer of Mountain View, California-based Shape Security. That means cybercriminals wielding 500m passwords could conceivably hijack tens of thousands of other accounts. “It becomes a numbers game for them,” Ghosemajumder said in a telephone interview.

Ghosemajumder said he didn’t see a surge in new breaches so much as a steady increase in attempts as cybercriminals replenish their stock of freshly hacked passwords.

The first hint that something was wrong at Yahoo came when Motherboard journalist Joseph Cox started receiving supposed samples of credentials hacked from the company in early July. Several weeks later, a cybercriminal using the handle “Peace” came forward with 5,000 samples – and the startling claim to be selling 200m more.

On 1 August, Cox published a story on the sale, but the journalist said he never established with any certainty where Peace’s credentials came from. He noted that Yahoo said most of its passwords were secured with one encryption protocol, while Peace’s sample used a second. Either Peace drew his sample from a minority of Yahoo data or he was dealing with a different set of data altogether. “With the information available at the moment, it’s more likely to be the latter,” Cox said in an email on Tuesday.

The Associated Press has been unable to locate Peace. The darknet market where the seller has been active in the past has been inaccessible for days, purportedly due to cyber-attacks. It is not known why a state-sponsored actor, which Yahoo has blamed for the breach, would have an interest in passing its data to people like Peace.

Yahoo users who recycle the same password across the internet may still be at risk. While people can always change their passwords across all the sites they use, Yahoo’s announcement that some security questions were compromised too means that the risks associated with the breach are likely to linger. A password can be changed – but your mother’s maiden name can’t.