sb-nz logo
Story image

Yahoo's 1bn user data breach: Everything you should know

Yahoo has uncovered another data breach, where more than 1bn user accounts were compromised in August 2013 - making it the largest data breach in history.

The company says it is ‘likely distinct’ from the data breach in September, and believes an unauthorised third party stole data associated with more than one billion user accounts in August.

Yahoo’s CISO, Bob Lord, confirmed the breach in a recent blog post saying that ’with the assistance of outside forensic experts…it appears to be Yahoo user data’.

“We have not been able to identify the intrusion associated with this theft. We believe this incident is likely distinct from the incident we disclosed on September 22, 2016,” writes Lord.

He says that for potentially affected accounts, the stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers.

However, Lord explains that the stolen information did not include passwords in clear text, payment card data, or bank account information.

“Payment card data and bank account information are not stored in the system the company believes was affected,” he writes.

For all potentially affected Yahoo users, most should have been notified, and the company has taken steps to secure their accounts, including requiring users to change their passwords.

Lord also mentions that they have invalidated unencrypted security questions and answers so that they cannot be used to access an account.

Commenting on the breach, Ryan Kalember, SVP of Cyber Security Strategy at Proofpoint, says it’s critical that consumers and business alike realise that email credentials can be the gateway to more sensitive information than nearly anything else.

“News of the additional Yahoo breach is yet another indication that email accounts are a prime target among criminals,” he says.

“Email is the top way cyber criminals are breaking into the world’s most sophisticated organisations and they target personal inboxes and account information with the same aggressiveness.”

Tyler Moffit, senior threat research analyst at Webroot, adds that this data breach is huge on so many levels.

“Yahoo says hackers stole names, email addresses, phone numbers, dates of birth and encrypted or unencrypted security questions and answers from more than 1 billion accounts,” he says.

“These accounts have been compromised for years and the sheer number of accounts means this has been a large source of identity theft already.

No one should have faith in Yahoo at this point and might very well affect the $4.8 billion Verizon deal.”

Story image
Why it’s essential to re-write IT security for the cloud era
Key components of network security architecture for the cloud era should be built from the ground up, as opposed to being bolted on to legacy solutions built for organisations functioning only on-premises or from only managed devices.More
Story image
Netlinkz revenue surges 846% as secure enterprise cloud technology gains traction
Executive chairman James Tsiolis believes this growth is the start of something much bigger.More
Story image
NortonLifeLock introduces dark web monitoring to its security suite
Dark Web Monitoring Powered by LifeLock will be capable of monitoring the dark web, searching for over 120 personal identifiable information including email, physical address, phone number, driver licence number, credit card or bank account numbers and gamer tags.More
Story image
SMBs seeking service providers in face of rising cyber threats
SMBs are struggling with their cybersecurity solutions, with three quarters worried about being the target of a cyberattack in the next six months, and 91% considering using or switching to a new IT service provider if offered a better option.More
Story image
Global attack volume down, but fraud and cyber threats still going strong
“The move to digital, for both businesses and consumers, has been significant. Yet with this change comes opportunity for exploitation. Fraudsters look for easy targets: whether government support packages, new lines of credit or media companies with fewer barriers to entry."More
Story image
Malware and email scams targeting employees spread rapidly in Q2
"Businesses must stay alert and should employ defense-in-depth tactics and equip themselves with multilayered security mechanisms, including high-sensor spam filters and a VPN connection, which would prevent malicious pages from opening."More