Updated Hackers strongly believed to be state-sponsored swiped account records for 500 million or more Yahoo! webmail users. And who knew there were that many people using its email?
The troubled online giant said on Thursday that the break-in occurred in late 2014, and that names, email addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers, were lifted.
This comes after a miscreant calling themselves Peace was touting copies of the Yahoo! account database on the dark web. At the time, in early August, Yahoo! said it was aware of claims that sensitive information was being sold online – and then today, nearly two months later, it alerted the world to the embarrassing security breach.
"We have confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by what it believes is a state-sponsored actor," said Yahoo!'s chief information security officer Bob Lord on Tumblr today.
"The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation has found to be affected.
"Based on the ongoing investigation, Yahoo believes that information associated with at least 500 million user accounts was stolen and the investigation has found no evidence that the state-sponsored actor is currently in Yahoo’s network. Yahoo is working closely with law enforcement on this matter."
Yahoo! has said it will email all those thought to be affected by the theft and is advising everyone who hasn't changed their passwords in the last two years to do so. If you've forgotten your password however, you could be out of luck – security questions that Yahoo! was storing in unencrypted format have been deleted from the system.
Unlike others, Yahoo! doesn't appear to be offering any kind of credit monitoring service for affected customers, but helpfully includes a link for users to check their own credit records. It also advises users to be on their guard against unsolicited emails.
The statement leaves many questions unanswered. For example – how many of these email accounts are actually active for a start. It's difficult to imagine that Yahoo! actually has half a billion active email users and a quick poll around the office shows just over half of Vulture West staff have a Yahoo! account but that none of us have used it in the last year.
Yahoo! also fails to point out that the chief benefit to the hackers isn’t going to be their email accounts, but other online identities. People foolishly tend to reuse passwords and security question answers and that's where the main value of the data comes from.
The hack is also going to cause consternation at Verizon, which has offered to buy out the ailing portal for $4.8bn. Now that Yahoo! could be facing the mother of all class action suits, Verizon might be rethinking that price. ®
Updated to add
In late July, Verizon announced its intention to gobble up Yahoo!, just days before account information was shopped around on the dark web. According to Verizon today, it has only just learned of the staggering data theft even though fears for Yahoo!'s security were well reported back in August.
"Within the last two days, we were notified of Yahoo's security incident. We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact," Verizon told The Reg in a statement.
"We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities. Until then, we are not in position to further comment."