500M Yahoo! Users Impacted by Hack; What It Says About Password Protection

By

Yahoo! is facing a lot of challenges lately. Add to the heap the breach – which the company confirmed today – that has affected 500 million Yahoo! accounts and is believed to have been carried out by a state-sponsored actor.

The breach, which dates back to late 2014, may have allowed unauthorized parties to access such information as Yahoo! account holder dates of birth, email addresses, names, telephone numbers, and security questions and answers (both encrypted and unencrypted), the company said. Yahoo! doesn’t think the breach included the theft of bank account information, payment card data, or unprotected passwords.

The company sent out an email and posted on its website a letter from Yahoo! CISO Bob Lord explaining the situation and what it is doing to protect its users. Yahoo! in the communications said it has invalidated unencrypted security questions and answers so they can’t be used to access an account, is working closely with law enforcement on the matter, and continues to upgrade its systems to identify and prevent unauthorized access to user accounts.

The company is also suggesting affected users change their passwords and adopt an alternate means of account verification, review their accounts for suspicious activity, avoid clicking on links or downloading attachments from suspicious emails, use caution in responding to unsolicited emails, and consider using the authentication tool Yahoo Account Key. Users with Yahoo Account Key don’t need passwords to sign into their accounts.

“Since we don’t have the specifics yet, it will be hard to say how everything happened,” notes Brad Bussie, CISSP, director of product management at STEALTHbits Technologies. “What we do know is that accounts that have been breached have value. The reason they have value is that people use the same password for multiple sites. The industry has been warning users for years that they need different complex passwords for each account they use online. The problem is that many consumers have dozens of accounts and remembering that many passwords is hard.” 




Edited by Alicia Young
Get stories like this delivered straight to your inbox. [Free eNews Subscription]

Executive Editor, TMC

SHARE THIS ARTICLE
Related Articles

Can Science Outsmart Deepfake Deceivers? Klick Labs Proposes an Emerging Solution

By: Alex Passett    3/25/2024

Researchers at Klick Labs were able to identify audio deepfakes from authentic audio recordings via new vocal biomarker technology (alongside AI model…

Read More

Top 5 Best Ways to Integrate Technology for Successful Project-Based Learning

By: Contributing Writer    3/19/2024

Project-based learning, also popularly known as the PBL curriculum, emphasizes using and integrating technology with classroom teaching. This approach…

Read More

How to Protect Your Website From LDAP Injection Attacks

By: Contributing Writer    3/12/2024

Prevent LDAP injection attacks with regular testing, limiting access privileges, sanitizing user input, and applying the proper encoding functions.

Read More

Azure Cost Optimization: 5 Things You Can Do to Save on Azure

By: Contributing Writer    3/7/2024

Azure cost optimization is the process of managing and reducing the overall cost of using Azure. It involves understanding the resources you're using,…

Read More

Massive Meta Apps and Services Outage Impacts Users Worldwide

By: Alex Passett    3/5/2024

Meta's suite of apps and services are experiencing major global outages on Super Tuesday 2024.

Read More