Yahoo reveals 500 million accounts hacked

By Barry Eitel

SAN FRANCISCO

Yahoo announced Thursday that it had been the victim of a massive hacking that compromised at least 500 million user accounts, with the company claiming the breach was sponsored by a government.

That figure would make the hack the biggest-ever data breach.

The company believes the breach occurred two years ago, and the information related to 200 million Yahoo accounts were recently advertised by a hacker on a black market site -- although it appears the breach was much worse than predicted.

“A recent investigation by Yahoo has confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by what it believes is a state-sponsored actor,” the company said in a statement. “The account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers.”

The Internet pioneer does not believe banking information was stolen.

“The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation has found to be affected,” Yahoo said. “Based on the ongoing investigation, Yahoo believes that information associated with at least 500 million user accounts was stolen and the investigation has found no evidence that the state-sponsored actor is currently in Yahoo’s network. Yahoo is working closely with law enforcement on this matter.”

The company urged anyone who has not changed passwords since 2014 to do so immediately.

Earlier this summer, Verizon announced it was acquiring Yahoo for $4.8 billion. The hack revealed Thursday could affect the deal, according to sources speaking to tech news outlet Recode, which first reported Yahoo would reveal information about the breach.

“Within the last two days, we were notified of Yahoo's security incident,” a Verizon spokesperson said in a statement after Yahoo confirmed the breach. “We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact. We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities.”