On This Day: Yahoo Admitted to a Breach of 500 Million Accounts

On September 22, 2016, Yahoo publicly acknowledged a breach affecting more than 500 million accounts. The attack took place in late 2014: an intruder copied a November backup of the user database for himself. The company knew about the intrusion for almost two years and disclosed it only amid the sale of its internet business to Verizon.

The stolen database contained names, email addresses, phone numbers, dates of birth and hashed passwords, as well as security questions and answers — some of them unencrypted. Most of the passwords were protected by the bcrypt algorithm, which is considered robust, but the rest may have used older schemes such as MD5 — those can be cracked quickly.

The public admission came as a surprise: as recently as September 9, in a report to the U.S. Securities and Exchange Commission, Yahoo stated that it was unaware of any breaches or data loss. The scale became clear only during an investigation into another incident in the summer of 2016. Verizon, the buyer of the internet business, learned about the hack itself two days before the announcement.

Then came the deal and its aftermath. The purchase price was cut by 350 million dollars, to 4.48 billion, the deal closed in June 2017, and the company that remained after the sale was named Altaba.

In March 2017, the FBI brought charges against four individuals, including two officers of Russia's FSB. Only the Canadian hacker Karim Baratov was arrested: five years in prison and 2.25 million dollars to pay. The bottom line for the company was 117.5 million dollars under a class-action settlement and a 35 million dollar fine from the U.S. Securities and Exchange Commission; the fine ultimately went to Altaba. The disclosure of the breach also drew criticism from U.S. senators and questions from European regulators.

Image: photographer Coolcaesar CC BY-SA 3.0 · License

Translation editors: Соловьев В., Пеков А.