At least 500 million users hit in attack on Yahoo

PanARMENIAN.Net - Yahoo! Inc. said the personal information of at least 500 million users was stolen in an attack on its accounts in 2014, exposing a wide swath of its roughly 1 billion users ahead of Verizon Communications Inc.’s planned acquisition of the web portal’s assets, Bloomberg News reports.

The attacker was a “state-sponsored actor,” and stolen information may include names, e-mail addresses, phone numbers, dates of birth, encrypted passwords and, in some cases, un-encrypted security questions and answers, Yahoo said Thursday, September 22 in a statement. The continuing investigation doesn’t indicate theft of payment card data or bank account information, or unprotected passwords, the company said. Affected users are being notified, accounts are being secured, and there’s no evidence the attacker is still in the network, Yahoo also said.

“Yahoo is working closely with law enforcement on this matter,” the company said in the statement. “Online intrusions and thefts by state-sponsored actors have become increasingly common across the technology industry.”

The disclosure of the data theft comes at a particularly sensitive time for Chief Executive Officer Marissa Mayer, as she navigates the company toward a planned $4.8 billion acquisition by Verizon, set to close by early next year. Mayer, who has dealt with difficulties and complaints about Yahoo’s e-mail service in the past, needs to keep users logging in to drive traffic and draw the advertising that fuels the company’s revenue growth, which has been sluggish under her leadership.

The company began investigating after receiving a report in July of a hacker claiming to have hundreds of millions of stolen Yahoo log-ins for sale on the black market, according to a person familiar with Yahoo’s probe. Investigators couldn’t find evidence backing up those claims. However, the person said Yahoo decided to conduct a deeper, separate investigation that uncovered the larger breach and notified Verizon this week. The person asked for anonymity to discuss internal findings.

Two other people familiar with the Yahoo investigation said the link to a nation state is not iron-clad. And Yahoo has yet to disclose the evidence on which it is basing the link to a nation state.

Claiming a hack was launched by a foreign government is the ultimate get-out-of-jail-free card for embarrassed corporate executives. As Bloomberg News previously reported, senior leaders at JPMorgan Chase & Co. lobbied the White House and various federal agencies to attribute a hacking attack against the bank in 2014 as being sponsored by Russia, but the FBI disagreed, and later filed criminal charges linking the breach to a stock pump-and-dump scheme, although there remained debate in the intelligence community about a possible government link.

Verizon was notified of the incident within the last two days, the company said in an e-mailed statement.