Yahoo has revealed that a state-sponsored actor stole email addresses, passwords and birth dates. In what appears to be the world’s biggest cyber theft, the hackers stole personal information associated with about 500 million Yahoo accounts.
Yahoo said the breach which took place in 2014 disclosed names, email addresses, phone numbers, birth dates and encrypted passwords, but unprotected passwords, payment card data and bank account information were not compromised.
The internet company, which was recently bought by Verizon, said it is working closely with law enforcement and urged its users to change their passwords. We will evaluate, as the investigation continues, through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities, Verizon said.
Cybercriminals know that consumers use the same passwords across websites and applications, which is why these millions of leaked password credentials are so useful for perpetuating fraud, said Brett McDowell, Executive Director of the FIDO Alliance, an organization that vets the security of password alternatives. “We need to take that ability away from criminals, and the only way to do that is to stop relying on passwords altogether.”
We typically see a 0.1 percent to 2 percent log-in success rate from credential stuffing attacks, meaning that a cybercriminal using 500 million passwords to attempt to take over accounts on another website would be able to take over tens of thousands of accounts on most websites, says Shuman Ghosemajumder, CTO at Shape Security.
According to a study by Alertsec , it will take Yahoo at least several months before it starts regaining users’ trust. “When a company has allowed their customers’ data to fall into the hands of criminals, the resulting lack of trust is difficult to repair,” CEO Ebba Blitz stated.
Yahoo’s former Information Security Officer, Jeremiah Grossman, said that Internet companies, especially giants like Yahoo, face challenges protecting enormous computer networks because the networks offer so many points of entry to attackers.It’s unsurprising when breaches, even of this magnitude, take place. Yahoo certainly isn’t the first and they won’t be the last, he affirmed.