Users will be asked to change their passwords.
Advertisement
It said on Thursday that it had only learned about the breach within the last two days. “We’ll just have to wait and see what happens next”.
The hack also surprised Verizon, which recently agreed to acquire Yahoo.
The attack on the firm’s network – which dates back to late 2014 – is the biggest such theft of user data to date.
Of all the information stolen by hackers, Nelson said security question details may be the most concerning to users.
While the breach comprised mostly low-value information, it did include security questions and answers created by users themselves. The company added that most of the passwords stolen were hashed with bcrypt, making them exceptionally hard to crack.
Yahoo said it was working with law enforcement on the matter, and the Federal Bureau of Investigation said it was investigating.
A former Yahoo employee said the Q&A were deliberately left unencrypted, which allowed Yahoo to catch fake accounts more easily because fake accounts tended to reuse questions and answers.
If you’re anxious about anyone-especially state-sponsored actors-stealing your personal data, you should seriously consider switching your accounts to Google.
Linn Freedman, a privacy attorney with Robinson & Cole LLP, said if a breach was confirmed, Yahoo would likely force users to change their passwords.
The Motherboard report was published a week after Verizon announced its deal with Yahoo.
Thursday’s breach might also be politically motivated.
“Yahoo is notifying potentially affected users and has taken steps to secure their accounts”, the company said. “Yahoo was once the number one email provider”.
Verizon, in a statement, said it was monitoring news of the breach.
“What it does is every time you access your Yahoo account from any device that is connected to the internet, it will push a notification to your phone saying ‘hey this computer at this IP address wants to access your account, you gonna allow me access?,'” added MacLean.
“We will evaluate as the investigation continues through the lens of overall Verizon interests”.
“Most stories will focus on Yahoo users, but the damage there appears to have been done months ago, and Yahoo will simply reset all their passwords so no further damage can be done”, he said, in a statement emailed to FoxNews.com.
Advertisement
The security breach is yet another bruise for the aging tech firm and chief executive Marissa Mayer, who joined Yahoo in 2012 to effect a turnaround and ended up having to sell the firm’s core assets instead. Yahoo revealed that a whopping 500 million people had account info stolen, but they don’t appear to be in Yahoo’s network anymore.
