500M Yahoo! Users Impacted by Hack; What It Says About Password Protection

By Paula Bernier September 23, 2016

Yahoo! is facing a lot of challenges lately. Add to the heap the breach – which the company confirmed today – that has affected 500 million Yahoo! accounts and is believed to have been carried out by a state-sponsored actor.

The breach, which dates back to late 2014, may have allowed unauthorized parties to access such information as Yahoo! account holder dates of birth, email addresses, names, telephone numbers, and security questions and answers (both encrypted and unencrypted), the company said. Yahoo! doesn’t think the breach included the theft of bank account information, payment card data, or unprotected passwords.

The company sent out an email and posted on its website a letter from Yahoo! CISO Bob Lord explaining the situation and what it is doing to protect its users. Yahoo! in the communications said it has invalidated unencrypted security questions and answers so they can’t be used to access an account, is working closely with law enforcement on the matter, and continues to upgrade its systems to identify and prevent unauthorized access to user accounts.

The company is also suggesting affected users change their passwords and adopt an alternate means of account verification, review their accounts for suspicious activity, avoid clicking on links or downloading attachments from suspicious emails, use caution in responding to unsolicited emails, and consider using the authentication tool Yahoo Account Key. Users with Yahoo Account Key don’t need passwords to sign into their accounts.

“Since we don’t have the specifics yet, it will be hard to say how everything happened,” notes Brad Bussie, CISSP, director of product management at STEALTHbits Technologies. “What we do know is that accounts that have been breached have value. The reason they have value is that people use the same password for multiple sites. The industry has been warning users for years that they need different complex passwords for each account they use online. The problem is that many consumers have dozens of accounts and remembering that many passwords is hard.” 




Edited by Alicia Young

Executive Editor, TMC

SHARE THIS ARTICLE
Related Articles

Modern Moms Shaping Influence

By: Maurice Nagle    7/19/2018

Everyone knows Mom knows best. The internet is enabling a new era in sharing, and sparking a more enlightened, communal shopping experience. Mommy blo…

Read More

Why People Don't Update Their Computers

By: Special Guest    7/13/2018

When the WannaCry ransomware attacked companies all over the world in 2017, experts soon realized it was meant to be stopped by regular updating. Even…

Read More

More Intelligence About The New Intelligence

By: Rich Tehrani    7/9/2018

TMC recently announced the launch of three new artificial intelligence events under the banner of The New Intelligence. I recently spoke with TMC's Ex…

Read More

Technology, Innovation, and Compliance: How Businesses Approach the Digital Age

By: Special Guest    6/29/2018

Organizations must align internally to achieve effective innovation. Companies should consider creating cross-functional teams or, at a minimum, incre…

Read More

Contribute Your Brain Power to The New Intelligence

By: Paula Bernier    6/28/2018

The three events that are part of The New Intelligence are all about how businesses and service providers, and their customers, can benefit from artif…

Read More