Yahoo Says 1 Billion User Accounts Were Hacked
SAN FRANCISCO — Yahoo, already under a cloud from its summertime disclosure that 500 million user accounts had been hacked in 2014, disclosed Wednesday that another attack a year earlier had compromised more than 1 billion Yahoo accounts.
The newly disclosed attack involved more sensitive user information, including unencrypted security questions. Yahoo is forcing all of the affected users to change their passwords and it is invalidating the security questions.
Yahoo had agreed to sell its core businesses to Verizon Communications for $4.8 billion. Verizon said that it might seek to renegotiate the terms of the transaction after the first hacking was disclosed. It’s unclear how the newest information will affect its view of the purchase.
Yahoo has made a steady trickle of disclosures about the 2014 hacking, which it has been investigating with the help of federal authorities. The company said Wednesday that it now believes the attacker in that breach, which it says was sponsored by a government, found a way to forge credentials to log in to some users accounts without a password.
Bob Lord, Yahoo’s chief information security officer, said in a statement that the state-sponsored actor in the 2014 attack had stolen Yahoo’s proprietary source code. Outside forensics experts working with Yahoo believe that the state-sponsored hackers used Yahoo’s code to access Yahoo user accounts without their passwords by creating forged “cookies,” short bits of text that a website can store on a user’s machine. By forging these cookies, attackers were able to impersonate valid users, gaining information and performing actions on behalf of their victims.
Security has taken a back seat at Yahoo in recent years, compared to Silicon Valley competitors like Google and Facebook. Yahoo’s security team clashed with top executives, including the chief executive, Marissa Mayer, over the cost and customer inconvenience of proposed security measures.
Security experts also say the time it has taken Yahoo to uncover the breach disclosed on Wednesday is a signal that the company’s security and monitoring technologies areinadequate.
“What’s most troubling is that this occurred so long ago, in August 2013, and no one saw any indication of a breach occurring until law enforcement came forward,” said Jay Kaplan, the chief executive of Synack, a security company. “Yahoo has a long way to go to catch up to these threats.”
In July, Yahoo agreed to sell its core businesses to Verizon Communications for $4.8 billion. Verizon said in October that it might seek to renegotiate the terms of the transaction because of the hacking, which had not been disclosed to Verizon during the original deal talks.
After the latest disclosure Wednesday, a Verizon spokesman, Bob Varettoni, essentially repeated that position.
“As we’ve said all along, we will evaluate the situation as Yahoo continues its investigation,” he said. “We will review the impact of this new development before reaching any final conclusions.”
Mr. Lord said Yahoo had taken steps to harden Yahoo’s systems following these attacks. The company encouraged its users to change passwords associated with their Yahoo account and any other digital accounts tied to their Yahoo email and account.
In the hacking disclosed Wednesday, Mr. Lord said Yahoo believed an “unauthorized third party” managed to steal datafor one billion Yahoo user accounts. Mr. Lord said that Yahoo had not been able to identify how the hackers were able to breach Yahoo’s systems, but that the company believed the incident occurred in August 2013.
Changing Yahoo passwords will be just the start for many users. They will also have to comb through other services to make sure passwords used on those sites are not too similar to what they were using on Yahoo. And if they were not doing so already, they will have to treat everything they receive online, such as email, with an abundance of suspicion, in case hackers are trying to trick them out of even more information.
Yahoo recommended that its customers use Yahoo Account Key, an authentication tool that verifies identity using a mobile phone and eliminates the need to use a password on Yahoo altogether.