500M Yahoo! Users Impacted by Hack; What It Says About Password Protection

By Paula Bernier September 23, 2016

Yahoo! is facing a lot of challenges lately. Add to the heap the breach – which the company confirmed today – that has affected 500 million Yahoo! accounts and is believed to have been carried out by a state-sponsored actor.

The breach, which dates back to late 2014, may have allowed unauthorized parties to access such information as Yahoo! account holder dates of birth, email addresses, names, telephone numbers, and security questions and answers (both encrypted and unencrypted), the company said. Yahoo! doesn’t think the breach included the theft of bank account information, payment card data, or unprotected passwords.

The company sent out an email and posted on its website a letter from Yahoo! CISO Bob Lord explaining the situation and what it is doing to protect its users. Yahoo! in the communications said it has invalidated unencrypted security questions and answers so they can’t be used to access an account, is working closely with law enforcement on the matter, and continues to upgrade its systems to identify and prevent unauthorized access to user accounts.

The company is also suggesting affected users change their passwords and adopt an alternate means of account verification, review their accounts for suspicious activity, avoid clicking on links or downloading attachments from suspicious emails, use caution in responding to unsolicited emails, and consider using the authentication tool Yahoo Account Key. Users with Yahoo Account Key don’t need passwords to sign into their accounts.

“Since we don’t have the specifics yet, it will be hard to say how everything happened,” notes Brad Bussie, CISSP, director of product management at STEALTHbits Technologies. “What we do know is that accounts that have been breached have value. The reason they have value is that people use the same password for multiple sites. The industry has been warning users for years that they need different complex passwords for each account they use online. The problem is that many consumers have dozens of accounts and remembering that many passwords is hard.” 




Edited by Alicia Young

Executive Editor, TMC

SHARE THIS ARTICLE
Related Articles

Why Blockchain Could Be a Gamechanger

By: Paula Bernier    1/22/2018

Blockchain has become closely associated with the controversial topic of cryptocurrency. And that's fine because blockchain is an enabling technology …

Read More

Consumer Privacy in the Digital Era: Three Trends to Watch

By: Special Guest    1/18/2018

Digital advertising has exploded in recent years, with the latest eMarketer data forecasting $83 billion in revenue this year and continued growth on …

Read More

CES 2018: Terabit Fiber - Closer Than We Think

By: Doug Mohney    1/17/2018

One of the biggest challenges for 5G and last mile 10 Gig deployments is not raw data speeds, but middle mile and core networks. The wireless industry…

Read More

10 Benefits of Drone-Based Asset Inspections

By: Frank Segarra    1/15/2018

Although a new and emerging technology, (which is still evolving), in early 2018, most companies are not aware of the possible benefits they can achie…

Read More

VR Could Change Entertainment Forever

By: Special Guest    1/11/2018

VR could change everything from how we play video games to how we interact with our friends and family. VR has the power to change how we consume all …

Read More