Yahoo said on Wednesday that over 1 billion user accounts have been compromised during the cyber attack, occurred in August 2013. This means that most of the Yahoo’s users have been affected worldwide. The data breach has leaked user’s information such as user names, passwords, Email IDs, telephone numbers, date of birth and other confidential information.
This breach that has been disclosed by Yahoo is believed to be separate and different from the data breach that occurred in September this year which had affected over 550 million user accounts. This means, Yahoo has been a victim of two biggest data breaches ever reported.
“We have not been able to identify the intrusion associated with this theft. We believe this incident is likely distinct from the incident we disclosed on September 22, 2016,” said Bob Lord, Chief Information Security Officer.
According to Bob Lord, Yahoo took help of outside forensic experts to examine the data provided by law enforcement and came to know that over 1 billion user accounts have been compromised.
“The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers,” added Bob Lord. The stolen information did not include clear text passwords, payment card data, or bank account information.
Yahoo is notifying affected users asking them to change their passwords. “We are notifying potentially affected users and have taken steps to secure their accounts, including requiring users to change their passwords,” said Bob Lord.
Yahoo disclosed that its proprietary code had been accessed by unauthorized third party which helped them to forge cookies that could be used to access accounts without a password. “Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies. The outside forensic experts have identified user accounts for which they believe forged cookies were taken or used. We are notifying the affected account holders, and have invalidated the forged cookies,” said Lord.
Reportedly, Yahoo employees knew of the intrusion that has affected over 550 million user accounts in 2014. The company did not announce the breach until September. And now, Yahoo disclosed another breach which has affected over 1 billion user accounts worldwide. It has been months since the deal with Verizon was announced. The breach has been raising questions like, If Yahoo knew about the breach before the company made deal with Verizon? and What Yahoo executives knew about the breach?
Back in July, Verizon agreed to buy Yahoo for $4.83 billion. After the breach, Verizon will now be asking for a massive discount to make a great deal. The discount that Verizon could ask is said to be $1 billion.
