2012 Yahoo Voices hack
| Industry | Internet services |
|---|---|
| Founded | 2006 |
| Parent | Yahoo |
In July 2012, Yahoo Voice, a platform for user-generated content under the ownership of Yahoo, suffered a major security compromise. On July 11, 2012, the hacker collective known as "D33DS Company" published nearly 450,000 login credentials obtained through a SQL injection attack that targeted weaknesses within Yahoo's database infrastructure.
The Breach
The following day, July 12, 2012, "D33DS Company" exploited a union-based SQL injection vulnerability to infiltrate Yahoo's servers and extract unencrypted user information—including email addresses and plaintext passwords—affecting roughly 450,000 Yahoo Voices accounts. Because the passwords were stored without encryption, malicious actors could immediately exploit the data without needing to decrypt it.
The group publicized the breach on Twitter (which has since been deleted) and shared the complete dataset via BitTorrent, facilitating widespread distribution. These compromised accounts were associated with Yahoo Voice (previously called Associated Content), which Yahoo had acquired in May 2010 for $100 million.
Yahoo acknowledged that the breach involved an outdated file from the Yahoo Contributor Network containing approximately 450,000 usernames and passwords, with fewer than 5% still active. Security company TrustedSec found that the email addresses spanned multiple domains such as yahoo.com, gmail.com, and aol.com. The leaked data appeared to stem from a database with records dating back to 2006, likely no longer in current use. At that time, Yahoo Voice had more than 600,000 contributors.
Experts in cybersecurity highlighted the severe risk posed by storing passwords in cleartext form, which could jeopardize users’ accounts beyond just Yahoo Voice. The hackers framed their disclosure as a cautionary message aimed at prompting improved security measures rather than causing harm, drawing attention to previous vulnerabilities and urging corrective steps.
This incident revealed significant deficiencies in Yahoo's security framework—especially regarding inadequate password safeguarding—and occurred alongside similar high-profile breaches at LinkedIn and other services, illustrating widespread challenges in protecting user information across the industry.
Response
In reaction to the breach, Yahoo committed to promptly addressing the security gap by fixing the vulnerability, resetting passwords for affected users, and informing impacted organizations. The event sparked criticism concerning Yahoo’s security protocols and insufficient data protection efforts. This breach served as an early warning sign of more extensive security breakdowns that would compromise billions of accounts in 2016.
Yahoo reiterated its dedication to enhancing security and outlined actions taken to resolve the issue, including password resets and notifications to other companies about the incident.
Controversy
Yahoo faced backlash for not issuing comprehensive site-wide alerts or sending individualized notifications to users instructing them to reset their passwords. Joseph Bonneau, a former product analysis manager at Yahoo and security expert, criticized the delayed integration of Associated Content accounts into Yahoo’s more robust login system, highlighting persistent vulnerabilities in password management.