Yahoo confirmed that information associated with at least 500 million user accounts had been stolen from its network in late 2014. The company said it believed a state-sponsored actor was responsible.
What happened
- The stolen data included names, email addresses, phone numbers, dates of birth, hashed passwords, and in some cases security questions and answers.
- Yahoo said payment card and bank account data were not believed to be affected.
- The disclosure came two months after Verizon agreed to buy Yahoo’s core business for $4.8bn, and the price was later cut by $350m.
- In December 2016 Yahoo disclosed a separate 2013 breach, which it later said affected all of its roughly 3 billion accounts.
Why it mattered
At the time it was the largest publicly disclosed breach, and the delay in disclosure drew criticism from regulators and showed how security failures can affect company valuations.
Lessons for organisations
Organisations should be able to detect intrusions quickly and have a plan for timely disclosure. Security questions are a weak authentication method and should be replaced with stronger options. Encourage users to adopt unique passwords, as stolen credentials are often reused in attacks on other services.
Source: NPR
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
