Yahoo Mail is a free email service operated by Yahoo. Its accounts suffered the two largest reported data breaches in the email industry: all 3 billion accounts in an August 2013 theft, and at least 500 million accounts in a separate late 2014 breach. The account itself can be secured with current sign-in methods, while the address remains in breach files that are still in circulation.
The 2013 theft
In August 2013, attackers stole account information for every Yahoo account then in existence: all 3 billion of them. The theft went undisclosed for years. On 14 December 2016, Yahoo announced a breach affecting about 1 billion accounts. On 3 October 2017, Oath, the Verizon subsidiary that had acquired Yahoo's internet properties, stated in an SEC filing that the August 2013 theft had affected all Yahoo user accounts, tripling the original figure, as Computer Weekly reported.
The stolen data, as described by Oath, included names, email addresses, telephone numbers, dates of birth, hashed passwords using MD5, and in some cases encrypted or unencrypted security questions and answers, per TechTarget's report. The same statement said the theft did not include passwords in clear text, payment card data, or bank account information. Yahoo required password changes and invalidated unencrypted security questions and answers for the affected accounts.
Analysts treated the 3-billion figure as the world's largest breach by number of accounts affected, according to GovTech. The 2013 theft was never publicly attributed: Marissa Mayer, Yahoo's CEO at the time, testified before the US Congress in 2017 that Yahoo could not determine who carried out the attack, as recorded in the Yahoo data breaches article.
The 2014 theft
On 22 September 2016, Yahoo announced that at least 500 million accounts had been compromised in an attack in late 2014, which Yahoo attributed to a "state-sponsored actor", per MacRumors. The data included names, email addresses, telephone numbers, birthdates, hashed passwords, and encrypted and unencrypted security questions and answers. Yahoo had in fact known about an intrusion into its network since 2014, as it stated in a November 2016 SEC filing; it said it had not understood the extent of the breach until it investigated a separate incident around July 2016.
Yahoo disclosed the 2014 breach to Verizon two days before the public announcement, while the acquisition of Yahoo's internet properties was in progress. The intruders went beyond stealing the database: they forged web cookies that allowed them to sign in without a password, and a 2017 SEC filing reported that 32 million accounts had been accessed through that cookie-forgery attack in 2015 and 2016.
On 15 March 2017, the US Department of Justice indicted four men for the 2014 breach: two officers of Russia's FSB intelligence service, Dmitry Dokuchaev and Igor Sushchin, and two hackers, Alexsey Belan and Karim Baratov, as WeLiveSecurity reported. Russian officials denied any involvement. Baratov, the only one arrested, pleaded guilty and was sentenced to five years in prison in May 2018.
Regulatory and legal consequences
On 24 April 2018, the SEC announced a $35 million settlement with Altaba, the renamed remainder of Yahoo, for failing to disclose the 2014 breach to investors, the first SEC action against an issuer over a cyber incident, per The Himalayan Times. In April 2019, a consumer class action settled for $117.5 million after a judge rejected an earlier accord, per The Business Times. In June 2018, the UK Information Commissioner's Office fined Yahoo UK Services £250,000 under the Data Protection Act 1998 over the 2014 breach (515,121 UK accounts exposed).
The breaches changed the terms of Yahoo's sale. Verizon had agreed to pay $4.83 billion for Yahoo's internet properties in July 2016; in February 2017 the price was cut by $350 million to $4.48 billion after the breach disclosures, and the sale closed in June 2017.
Account security
Yahoo's current account protections are set out by the company's Paranoids security team, whose published guide recommends 2-step verification with three sign-in methods: an app push notification to a Yahoo app on the user's phone, a passkey using fingerprint or Face ID, or an SMS code. The guide also recommends keeping at least two recovery channels on file, using a password manager for unique passwords, and enabling carrier SIM protection against SIM swapping.
The guide's own descriptions state the mechanisms and their limits together. With a passkey, the secret stays on the device and the biometric data never leaves it, so there is nothing for a phishing page to steal. SMS codes are the weakest of the three methods, because a SIM swap lets an attacker take over the phone number and intercept the code, which is the attack the guide's SIM-protection section describes. The password-manager section notes that autofill works only on the legitimate site, which stops credentials being entered on a forged login page.
Yahoo's 2016 breach guidance also recommended its Account Key feature, a passwordless sign-in introduced in 2015. Its current availability could not be verified for this article; the current Paranoids guide lists only app push, passkey, and SMS.
Address exposure
The account can be hardened. The address is a different matter. Yahoo addresses have appeared in breach files since the 2013 theft, and those files are still in circulation more than a decade later. A search on Have I Been Pwned confirms exposure in seconds, and the guide to the pwned screen explains how to read a red result.
The exposure enables two attacks. Credential stuffing replays the leaked password, or near variants of it, against Yahoo and every other account where the same password was used. Phishing uses the leaked details, the service name, the phone number, the date of birth, to build notices that look as if they come from Yahoo or a bank. The two responses to email and password breaches treat these as separate cases: change the locks for a password leak, watch for persuasion for an address leak. Yahoo's breaches handed attackers both.
One property of leaked addresses does not change: a new password, a passkey, and 2-step verification all protect the account, and none of them remove the address from files already stolen. The address is exposed permanently; the account is only as secure as its current settings.
AliasFleet
AliasFleet is an email-alias service that forwards incoming mail from dedicated aliases to the user's real inbox. It supports custom domains, two-way replies, and sender rules. The company states that it does not scan email content and runs no ads. The Free tier covers 10 active aliases, 1 verified destination inbox, and two-way reply forwarding.
AliasFleet maps onto the split described above. The Yahoo address stays as the destination inbox, protected by a passkey and 2-step verification. Websites and newsletters get per-site aliases instead, so a breach of any one site leaks that site's alias, which the user can disable on its own. The leaked alias names its source, because no other site held it.
What AliasFleet does not do in this case: it does not remove the Yahoo address from the breach files it already sits in, it does not secure the Yahoo account itself, and it does not change what Yahoo holds or scans. It changes the circulation of the address from this point on. The guide to securing an email account puts the account hardening first and the address hygiene second, in that order.
The same account-versus-address split is covered for Google's and Microsoft's inboxes in the pieces on Gmail and Outlook. The Yahoo case holds the largest and oldest of the three breach records, and its address files are the most widely circulated.
Top comments (0)