Yahoo data breaches
| Company type | Subsidiary (former) |
|---|---|
| Industry | Internet services |
| Founded | March 2, 1994 in Sunnyvale, California, United States |
| Founder | Jerry Yang, David Filo |
| Headquarters | Sunnyvale, California , United States |
| Products | Web portal, search engine, email service, news, finance, and other online services |
| Parent | Verizon Communications (acquired 2017) |
In 2013 and 2014, Yahoo, a prominent American internet services provider, experienced two of the most extensive data breaches ever recorded. Despite being aware of these incidents, the company postponed revealing them to the public until September 2016.
The breach in 2013 compromised the data of all three billion Yahoo user accounts. The subsequent 2014 breach affected over 500 million accounts. Both events rank among the largest breaches in history, exposing users' names, email addresses, phone numbers, birth dates, and security questions—some encrypted and others not. When Yahoo finally disclosed the breaches in 2016, it admitted to having known about the second breach since 2014.
These security failures resulted in indictments against four individuals involved in the later attack, including Canadian hacker Karim Baratov, who was sentenced to five years in prison. The fallout sparked significant criticism over Yahoo's slow reaction, a $117.5 million class-action lawsuit settlement, a $35 million penalty imposed by the U.S. Securities and Exchange Commission, Congressional investigations, and challenges for Verizon Communication's acquisition of Yahoo in 2017.
August 2013: breach
The initial data breach took place in August 2013 on Yahoo’s servers and compromised all three billion user accounts.[1][2] This breach was publicly announced on December 14, 2016.[3] In testimony before Congress in 2017, then-CEO Marissa Mayer revealed that Yahoo had been unable to identify those responsible for the 2013 intrusion.Cite error: The opening <ref> tag is malformed or has a bad name
Early 2014: security culture at Yahoo
Following whistleblower Edward Snowden’s revelations that Yahoo was frequently targeted by state-sponsored hackers, the company appointed chief information security officer Alex Stamos in 2014. Although his hiring indicated an intention to bolster security measures, CEO Marissa Mayer reportedly declined to allocate adequate resources for his team’s recommended improvements, resulting in Stamos’s departure by 2015.
Late 2014: breach
In late 2014, a hacker believed to be Russian national Alexey Belan duplicated a backup of Yahoo's User Account Database containing information on more than 500 million users. The stolen data comprised usernames, email addresses, phone numbers, birthdates, hashed passwords, and in some cases both encrypted and unencrypted security questions and answers.
While most passwords were secured using the bcrypt hashing algorithm—which is notably resistant to cracking—some were protected with older methods such as MD5 that are more susceptible to compromise. Between October 2014 and at least November 2016, Belan and his collaborators exploited this data for illegal activities including searching emails for gift card codes, targeting specific accounts, manipulating business search rankings they favored, and leveraging Yahoo information to hack accounts on other platforms like Gmail. They also enlisted Canadian hacker Karim Baratov to assist with breaching accounts on additional services.
July 2016 to October 2017: public disclosures
In June 2016, credentials for approximately 200 million Yahoo accounts were found for sale on the darknet marketplace TheRealDeal. Yahoo confirmed the authenticity of this data but initially refrained from resetting affected passwords.[4]
Yahoo publicly revealed the 2014 breach on September 22, 2016. The company invalidated unencrypted security questions and urged users impacted by the attack to update their passwords.[5] Yahoo attributed this intrusion to state-sponsored actors and stated there was no evidence of ongoing unauthorized access.[5] The FBI confirmed an investigation was underway. However, a cybersecurity firm with database access suggested that criminals were repeatedly selling the stolen data.Cite error: The opening <ref> tag is malformed or has a bad name
In a November 2016 filing with the U.S. Securities and Exchange Commission (SEC), Yahoo disclosed it had been aware of a breach dating back to 2014 but only fully understood its extent during investigation of a separate incident in 2016.[6][7] This contradicted an earlier September filing which denied prior knowledge of breaches. The November report described a cookie-based attack that enabled hackers to access accounts without needing passwords.[6][8]Cite error: The opening <ref> tag is malformed or has a bad name A subsequent SEC filing in 2017 confirmed that approximately 32 million accounts had been accessed through this technique between 2015 and 2016.Cite error: The opening <ref> tag is malformed or has a bad name
In December 2016, Yahoo disclosed a breach from 2013 affecting one billion user accounts.[9] By October 2017, this figure was updated to include all three billion Yahoo accounts as compromised.[9]
An internal investigation revealed that CEO Marissa Mayer and other senior executives were aware of these intrusions but failed to respond or disclose them promptly. This led to General Counsel Ronald S. Bell resigning by March 2017 and Mayer forfeiting $12 million in equity awards and bonuses for both 2016 and 2017.Cite error: The opening <ref> tag is malformed or has a bad name
Prosecution
On March 15, 2017, the FBI formally charged four individuals connected to the 2014 cyber intrusion, among them two operatives linked to Russia's Federal Security Service (FSB). According to the FBI, the illegal activities involved FSB officers who also act as the bureau's cybercrime liaisons in Moscow.
The defendants named were hacker Alexsey Belan, who appears on the FBI Ten Most Wanted Fugitives list; FSB agents Dmitry Dokuchaev and Igor Sechin, accused of compensating Belan and others for executing the hack; and Canadian hacker Karim Baratov. The FBI asserted that Dokuchaev and Sechin paid Baratov to exploit Yahoo breach data to infiltrate approximately 80 accounts outside of Yahoo. Russian authorities have denied any participation.
Baratov was extradited to the United States in August 2017. He admitted guilt for hacking at least 80 email accounts on behalf of Russian contacts, faced nine hacking charges, and was sentenced in May 2018 to five years imprisonment, accompanied by $2.25 million in fines and restitution. His memoir released in 2023 describes a lavish lifestyle financed through compromising thousands of email accounts.
Reactions and criticism
Yahoo encountered widespread condemnation for its tardy detection and disclosure of security breaches, as well as for its slow adoption of stronger protective measures.
Verizon Communications deal
Before publicizing the breaches, Verizon Communications had been in discussions to purchase a segment of Yahoo's assets for $4.8 billion, with closure anticipated in March 2017. Yahoo informed Verizon about the 2014 breach only two days prior to making it public in September 2016. Verizon CEO Lowell McAdam commented that cyberattacks are an unavoidable hazard in today's digital environment. In February 2017, Verizon moved forward with the acquisition but negotiated a $350 million reduction, lowering the price to $4.48 billion. The sale was finalized in June 2017, coinciding with CEO Marissa Mayer’s departure. Under updated terms, Verizon and Yahoo agreed to share expenses related to ongoing government probes into the breaches. The remaining Yahoo entity retaining unsold assets was renamed Altaba in June 2017. Subsequently, Altaba—not Verizon—was penalized by the SEC with a $35 million fine.
United States government
A group of six U.S. Senators, including Elizabeth Warren and Patrick Leahy, pressed Mayer for explanations regarding Yahoo’s delayed reporting of the 2014 breach, labeling the delay as "unacceptable." On September 26, 2016, Senator Mark Warner called upon the SEC to determine if Yahoo and its executives complied with federal securities disclosure requirements. In 2017, the SEC imposed a $35 million penalty on Altaba for failing to promptly report the breach.
Class action lawsuits
By November 2016, twenty-three lawsuits related to the 2014 breach had been initiated against Yahoo. One complaint filed in the U.S. District Court for the Southern District of California accused Yahoo of unauthorized access involving personal financial information. In December 2016, five cases were consolidated into a single proceeding. This litigation was later expanded to encompass the August 2013 breach as well.
Ahead of trial, Verizon and Altaba agreed in October 2018 on a $50 million settlement covering an estimated 200 million affected users, which included two years of complimentary credit monitoring services. However, a judge rejected this deal due to concerns over transparency and excessive legal fees. In April 2019, Yahoo reached a new settlement valued at $117.5 million that again provided credit monitoring along with cash awards contingent on class member participation.
International
Concerns regarding Yahoo's data breaches were raised by foreign governments. In October 2016, European privacy authorities, including the Article 29 Data Protection Working Party, drew attention to the 2014 breach and claims that Yahoo monitored users' incoming emails at the behest of U.S. intelligence agencies. They called on Yahoo to provide full disclosure of the breach to EU regulators, inform affected users, and collaborate with national data protection inquiries. Ireland's Data Protection Commissioner, responsible for overseeing Yahoo's European operations based in Dublin, determined that Yahoo did not comply with EU data protection requirements and failed to ensure its data processors applied sufficient security protocols, although no penalties were issued. Additionally, Germany's Federal Office for Information Security criticized Yahoo's cybersecurity measures and recommended that government entities and other German users consider service providers with more robust security standards.
See also
External links
es:Yahoo!#Filtración de datos fr:Yahoo!#Vol de données
- ↑ Cite error: Invalid
<ref>tag; no text was provided for refs namedwsj oct2017 - ↑ Cite error: Invalid
<ref>tag; no text was provided for refs named:2 - ↑ Cite error: Invalid
<ref>tag; no text was provided for refs named:6 - ↑ Cite error: Invalid
<ref>tag; no text was provided for refs namedmotherboard aug2016 - ↑ 5.0 5.1 Cite error: Invalid
<ref>tag; no text was provided for refs named:0 - ↑ 6.0 6.1 Cite error: Invalid
<ref>tag; no text was provided for refs namedwash1 - ↑ Cite error: Invalid
<ref>tag; no text was provided for refs namedtnyt1 - ↑ Cite error: Invalid
<ref>tag; no text was provided for refs namedbbc2 - ↑ 9.0 9.1 Cite error: Invalid
<ref>tag; no text was provided for refs named:1