The Yahoo Breaches (2013-2014): When Billions of Accounts Leak

Yahoo's two enormous breaches exposed data from hundreds of millions of accounts, then a billion, then all three billion, and the company took years to say so. What was stolen, how the story unravelled, and why a leaked email account is worse than it sounds.

An email account isn't really about email. It's the account that can reset all your other accounts: the bank, the shops, the social profiles, the cloud storage. Whoever controls it is standing next to a master key.

So when Yahoo told the world in the autumn of 2016 that hackers had taken data from at least 500 million of its accounts, people paid attention. Then the number grew. First to a billion, then to every single account the company had ever held. It became one of the largest data breaches ever reported, and a case study in how badly a company can handle one.

A number that kept growing

The story arrived in three instalments, and each one made the previous figure look small.

500M

September 2016. Yahoo says a "state-sponsored" actor stole data from at least 500 million accounts, in an intrusion dating back to late 2014.

December 2016. A second, separate theft is revealed. This one happened in August 2013 and involved more than a billion accounts.

October 2017. After further investigation, the company, by now owned by Verizon, says the 2013 theft affected all of its accounts, about three billion.

One caution about that last figure. Three billion accounts is not three billion people. Many users had several Yahoo accounts, and plenty of accounts had been left untouched for years. It's still an astonishing number, but it's worth remembering that it counts accounts, not individuals.

What was taken

According to the company's notices, the stolen records could include names, email addresses, phone numbers, dates of birth, passwords in scrambled (hashed) form, and in some cases security questions and answers. Yahoo said payment card data wasn't part of what was stolen.

That might sound reassuring, but think about what that bundle gives a criminal. A real name, a birth date and a phone number are exactly what you need to make a scam message convincing. A password hash is far safer than a plain-text password, yet weak scrambling or a simple password can be cracked, and plenty of people reuse the same password elsewhere. And security answers, as we'll see, are a nasty problem on their own.

How it happened, as far as anyone knows

The 2014 intrusion is the better documented one. In March 2017, US prosecutors charged four people over it, including two officers from Russia's FSB intelligence service. The indictment alleged that the officers directed and paid criminal hackers, and that one of the men stole a copy of Yahoo's user database in late 2014. It also alleged that the attackers used forged cookies to get into at least 6,500 accounts.

That detail is worth a pause. A cookie is a small file that tells a website you've already logged in. If someone can forge one, they can walk into an account without ever knowing the password. It's a useful reminder that a strong password isn't the only thing standing between you and a break-in.

The 2013 theft is murkier. Reporting at the time noted that the company hadn't publicly explained how attackers got in, years after the event. Some reports pointed to a state-sponsored attack, but no strong evidence was made public. It's one of those cases where honesty requires admitting how much we don't know.

Years of silence

The hackers weren't the only part of the scandal. The delay in telling people was almost as damaging. The 2014 theft was disclosed in September 2016, roughly two years later. The 2013 theft had gone unreported for more than three years when it finally came out in December 2016.

The timing was awkward. Verizon had agreed in 2016 to buy Yahoo's core business for around $4.8 billion, and the breaches emerged while the deal was pending. Verizon negotiated a reduction of $350 million, bringing the price to about $4.5 billion, and the sale closed in June 2017.

The consequences kept coming. In 2018 the US Securities and Exchange Commission fined Altaba, the company left behind after Verizon bought Yahoo's main business, $35 million for failing to disclose the 2014 breach in a timely way. There were lawsuits too. Settlements reported over the following years included $80 million for shareholders and a $50 million package for affected users, along with free credit monitoring.

Why a leaked email account is worse than it sounds

It's tempting to shrug and say "it was only an old Yahoo account". But a leaked email account has a way of causing trouble well beyond itself:

It's the key to password resets. Almost every site will send a reset link to your email. Control the inbox and you can often take over the accounts attached to it.
Reused passwords travel. If your Yahoo password was also your shopping password, attackers can try it everywhere. Reporting on the indictment noted that attackers may also have reached non-Yahoo sites where people had shared the same password.
Security answers can't be changed. Your mother's maiden name or your first school stays the same for life. Once those answers leak, they're compromised for good, on every site that asks.
Real details make scams convincing. A phishing email that knows your name, birthday and phone number is a great deal harder to dismiss. Our walkthrough of how phishing works and how to spot it shows the other side of this.
Leaked addresses feed the spam machine. Breach dumps get traded and reused for years, which is part of how the problem described in the rise of email spam keeps growing.

If your address has been in a breach

Chances are that it has been in at least one. You can check for free on a service like Have I Been Pwned (haveibeenpwned.com), which lets you enter an email address and see which known breaches included it. If it turns up, here's a calm, sensible response:

Change the password on the affected account, and on any other account where you used the same or a similar one.
Make every password unique. A password manager does this for you without any memorising.
Turn on two-step login, preferably with an authenticator app, for your email above all.
Stop using real answers to security questions. Where a site insists, enter a random string and store it in your password manager. It works as long as you can retrieve it.
Watch for follow-up scams that mention details from the breach, and don't click links in messages you weren't expecting.
Consider a fresh address for important accounts. A new email used only for banking and similar services is harder to find on old leak lists.

What a throwaway address would and wouldn't have done

It's worth being honest here. If Yahoo was your main email, a temporary address elsewhere wouldn't have protected you from this breach. The thief took the accounts themselves.

What does stay in your hands is how many places hold your real address and password. Every site you register with is a potential Yahoo-sized story in miniature, and most of them are far less well defended. Using a disposable address for low-stakes signups means that when one of those sites leaks, the stolen record is an address that expired long ago, not the one tied to your life. We explain how that pipeline starts in what happens to your email after a free trial, and how to decide which address deserves which job in temporary email vs. email alias.

What changed afterwards

The Yahoo saga made two lessons hard to ignore. Companies learned that hiding a breach is likely to cost more than the breach, in fines, lawsuits and lost deal value. And buyers learned to look hard at a target's security history before signing, since a hidden breach can change the price of an acquisition. Regulators also became far more interested in how quickly firms tell investors and the public that something has gone wrong.

For the rest of us, the lesson is more personal. We don't control how well a company protects its servers. We do control how much we hand over, how strong and unique our passwords are, and whether a stolen copy of one account can open the door to the rest.

One key, many copies

Your email address is a key that fits more locks than you'd like. The Yahoo breaches showed what happens when a few billion copies of that key end up in the wrong hands, and how long it can take for anyone to admit it. You can't take back a key that's already out there. But you can stop handing out spares to everyone who asks.

The Yahoo Breaches (2013-2014): What Happens When Billions of Email Accounts Leak