The Yahoo Breaches: How 3 Billion Accounts Were Exposed
Yahoo disclosed huge breaches in 2016 and later said all 3 billion accounts were affected in 2013. A look at what happened, the price cut and what it teaches.
In September 2016, Yahoo announced that data from at least 500 million user accounts had been stolen in 2014. Three months later it revealed another, larger breach from 2013. In 2017 it revised the 2013 figure upward to every account that existed at the time, about three billion. Together, the incidents are the largest account breaches ever disclosed by a single company, and they changed the price of a major corporate takeover.
The 2014 breach
On 22 September 2016 Yahoo said that a copy of user account information had been stolen from its network in late 2014 by what it believed was a state-sponsored actor. The information included names, email addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, security questions and answers. Yahoo said that unprotected passwords, payment card data and bank account information were not believed to be part of the stolen data.
The 2013 breach
On 14 December 2016 the company announced that it had identified data files provided by a law enforcement agency that suggested an unauthorised third party had stolen data from more than one billion accounts in August 2013. Yahoo said it had not yet identified the intrusion. The stolen data included similar personal details, and the passwords were stored using MD5, a hashing method that is now considered weak and fast to crack. In October 2017, after further analysis with outside experts, Yahoo said that all of its roughly three billion accounts had been affected.
Forged cookies
In early 2017 Yahoo disclosed a third issue. Attackers had used forged cookies, a trick that lets someone log in without a password, to access some accounts in 2015 and 2016. The company said that the same intruder was linked to the 2014 theft. Yahoo said that around 32 million accounts were affected by this, and that its source code had been stolen to create the forged cookies.
The legal and financial consequences
The timing was awkward: Yahoo had agreed in July 2016 to sell its core internet business to Verizon. After the breaches became public, the deal was renegotiated. In February 2017 the price was reduced by 350 million US dollars, to about 4.48 billion, and the two companies agreed to share liabilities from the breaches. The sale was completed in 2017.
In March 2017, US prosecutors indicted four people over the 2014 intrusion, including two officers of the Russian security service FSB. A Canadian man, Karim Baratov, who had been hired to break into email accounts, pleaded guilty and was sentenced to five years in prison in 2018. The US Securities and Exchange Commission fined the company, by then Altaba, 35 million dollars in 2018 for failing to disclose the breach to investors promptly. Yahoo also settled class actions brought by users.
Why it took so long
The SEC said that Yahoo's senior management and legal staff knew of the 2014 theft within days but did not properly assess it or disclose it for roughly two years. The delay denied users the chance to change their passwords and watch for fraud. It is a textbook example of why breach notification rules exist. In the European Union, the GDPR now requires companies to notify regulators within 72 hours of becoming aware of a personal data breach, where feasible, and to inform affected people when the risk to them is high.
What to learn from the Yahoo case
| Problem | Better practice |
|---|---|
| Weak password hashing (MD5) | Use a slow, salted algorithm such as bcrypt or Argon2 |
| Slow disclosure | Have a breach notification plan and an owner for it |
| Forged session tokens | Protect signing keys and rotate them after any incident |
| Years of undetected access | Monitor logins and data movement |
Why old accounts matter
One reason the 2013 figure was so large is that Yahoo, like many long-lived services, kept a huge number of accounts that were no longer used. Dormant accounts are still a risk, because they hold personal data and often reuse a password that people also use elsewhere. For an attacker, a list of email addresses and cracked passwords is a toolkit for trying to log in on other sites, a technique known as credential stuffing.
The lesson for any service with user accounts is to review inactive ones. Consider deleting accounts and data that have not been used in years, tell users you are doing so and make it easy to close an account. The less data you hold, the less there is to lose. This is also consistent with European data protection principles, which say that personal data should be kept only as long as necessary for the purpose it was collected.
Users have a role as well. A password manager and unique passwords for each site turn a breach at one service into a contained event instead of a chain reaction.
The practical lesson for site owners
If your site has user accounts, make sure the software stores passwords with a modern hashing method; most current versions of WordPress and other major systems do. Keep the software updated, protect secret keys and tell users promptly if something happens. Encourage unique passwords and two-factor authentication for your own administrators.
It also helps to know what you would do on the day of an incident. Our security page describes how our plans can support you, and our knowledge base covers securing user accounts on your site.
