The internet giant said it appeared separate from a 2014 breach disclosed in September, when Yahoo revealed 500 million accounts had been accessed.

Yahoo said names, phone numbers, passwords and email addresses were stolen, but not bank and payment data.

The company, which is being taken over by Verizon, said it was working closely with the police and authorities.

Yahoo said in a statement that it “believes an unauthorized third party, in August 2013, stole data associated with more than one billion user accounts.”

The breach “is likely distinct from the incident the company disclosed on September 22, 2016”.

However, the three-year-old hack was uncovered as part of continuing investigations by authorities and security experts into the 2014 breach, Yahoo said.

Account users were urged to change their passwords and security questions.

Vulnerability

Cybersecurity expert Troy Hunt told the BBC “This would be far and away the largest data breach we’ve ever seen. In fact, the 500 million they reported a few months ago would have been, and to see that number now double is unprecedented.

“Yahoo hasn’t attributed the attack to any state-sponsored activity as they did with the previous incident. They’ve referred to the tampering of cookies, though, which gives us some useful insight into where the vulnerability may have existed in their system.”

When Yahoo, in September, disclosed the 2014 data breach, it said information had been “stolen by what we believe is a state-sponsored actor”. Yahoo did not say which country it held responsible.

Yahoo has come under pressure to disclose why it took so long for that breach to be made public.

The California-based company has more than a billion monthly active users, although many people have multiple accounts. There are also many accounts that are little used or dormant.

The latest disclosure raises fresh questions about Verizon’s $4.8bn proposed acquisition of Yahoo, and whether the US mobile carrier will try to modify or abandon its bid.

‘Pattern of serious failures’

If the hacks cause a user backlash against Yahoo, the company’s services would not be as valuable to Verizon.

In a statement, Verizon said that it would evaluate the situation as Yahoo investigates and would review the “new development before reaching any final conclusions”.

Mr Hunt said that Verizon allegedly devalued Yahoo by $1bn after the news emerged of the 2014 attack.

The latest revelations “will surely impact that valuation even further, not just because of the scale of it, but because it shows a pattern of serious failures on Yahoo’s behalf,” he said.

It is a further embarrassment to a company that was once one of the biggest names of the internet but which has failed to keep up with rising stars such as Google and Facebook.

Yahoo’s valuation hit $125bn during the dot-com boom, but it has been losing ground since then despite several attempts to revive its fortunes.

Analysis: Dave Lee, North America technology reporter

Good grief, can things get any worse for Yahoo? A complete disaster. Embarrassing. Negligent?

We’ve come to accept that even the best systems get attacked by cyber criminals. But repeatedly? And in such great numbers? Something was seriously, seriously wrong.

Looking to the future, this is yet more concern for Verizon, which agreed to buy Yahoo before all of these disasters were made public.

It wanted the company because of its huge user-base and advertising reach. How many of those users are going to stick around when this kind of thing is going on? What’s in it for them?

There’s talk of a discount on the $4.8bn Verizon agreed to pay out. It’s a game of how-low-can-you-go in the new year, you’d think.

–

Source: BBC

The post ‘One billion’ affected by Yahoo hack appeared first on Citi 97.3 FM - Relevant Radio. Always.

The breach included swathes of personal information, including names and emails, as well as “unencrypted security questions and answers”.

It did not include any credit card data, the site said, adding it believed the attack was state-sponsored.

In July, Yahoo was sold to US telecoms giant Verizon for $4.8bn (£3.7bn).

The FBI has confirmed it is investigating the attack.

Password change urged

News of a possible major attack on the technology firm emerged in August when a hacker known as “Peace” was apparently attempting to sell information on 200 million Yahoo accounts.

Yahoo on Thursday confirmed the breach was far bigger than first thought.

The data taken includes names, email addresses, telephone numbers, dates of birth and encrypted passwords.

Yahoo recommended all users should change their passwords if they had not done so since 2014.

Questions for Yahoo: Analysis by Dave Lee, BBC North America technology reporter, San Francisco

The nature of the information stolen feels somewhat run-of-the-mill – no payment info, and passwords were encrypted. Good. But the chain of events leading up to this unprecedented announcement gives rise to some incredibly pressing questions for Yahoo.

Why did it take so long for them to confirm the hack and its scale? Why did it take them so long to tell users and prompt them to protect themselves?

State-sponsored attacks are typically for political, not financial gain. So why were details reportedly being sold online? What evidence is there that it was state-sponsored?

Verizon, which has agreed to buy Yahoo, said it had not been told until a couple of days ago – why not? And why is Marissa Mayer, a chief executive who has presided over bad deals and now the biggest breach in internet history, still in charge?

Verizon told the BBC it had learned of the hack “within the last two days” and said it had “limited information”.

The company added: “We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities.

“Until then, we are not in position to further comment.”

Yahoo said in a statement: “Online intrusions and thefts by state-sponsored actors have become increasingly common across the technology industry.”

Reuters reported three unnamed US intelligence officials as saying they believed the attack was state-sponsored because it was similar to previous hacks linked to Russian intelligence agencies.

Nikki Parker, vice-president at security company Covata, said: “Yahoo is likely to come under intense scrutiny from regulators, the media and public and rightly so. Corporations can’t shy away from data breaches and they must hold their hands up and show that they are committed to resolving the problem.”

She added: “Let’s hope the ink is dry on the contract with Verizon.”

Questions are being asked about the length of time it took Yahoo to fully acknowledge the breach.

“It is really worrying that a breach from 2014 can have gone undetected for so long,” said Prof Alan Woodward from the University of Surrey.

“It is also surprising the public statement took so long to appear.

Top 10 previous breaches

• MySpace accounts – 359m
• LinkedIn accounts – 164m
• Adobe accounts – 152m
• Badoo accounts – 112m
• VK accounts – 93m
• Dropbox accounts – 68m
• tumblr accounts – 65m
• iMesh accounts – 49m
• Fling accounts – 40m
• Last.fm accounts – 37m

“I would have thought most companies had learned by now that early disclosure is better, even if you have to revise and update as you learn more.

“I can understand a few days delay to confirm the breach is genuine as fake data dumps are increasingly common, but six weeks seems rather too long.”

The scale of the hack eclipses other recent, major tech breaches – such as MySpace (359 million), LinkedIn (164 million) and Adobe (152 million).

Yahoo was founded in 1994 by Jerry Yang and David Filo and in its first decade was a pioneer of internet services.

It was once the most popular website in the US and the company was worth about $125bn, but Yahoo lost ground towards the end of the first decade of the century, leading to its purchase by Verizon.

Verizon’s motivation for purchasing the struggling Yahoo was to simply gain its massive user base.

More than a billion people visit a Yahoo-owned site every month, and Verizon was hoping to use that to sell targeted advertising.

Yahoo Timeline

• 1994 Yahoo – which stands for Yet Another Hierarchically Organized Oracle – is founded

• 2000 Yahoo valued at $125bn at height of dot.com boom

• 2002 Google rejects a $3bn bid from Yahoo

• 2008 Microsoft’s $44.6bn offer for Yahoo is turned down

• 2013 Blogging site Tumblr acquired by Yahoo for $1.1bn

• 2015 Yahoo makes net loss of $4.4bn

• 2016 Verizon agrees $4.8bn deal to buy Yahoo

–

Source: BBC

The post Attack on Yahoo hit 500 million users appeared first on Citi 97.3 FM - Relevant Radio. Always.