What is Yahoo Data Breach?
Two massive data breaches at Yahoo — one in 2013 affecting all 3 billion accounts and another in 2014 affecting 500 million accounts — making them the largest data breaches in history by number of affected users.
Also known as: Yahoo Hack, Yahoo Data Leak, Biggest Data Breach Ever
Yahoo holds the record for the largest data breach in history — all 3 billion user accounts were compromised. The breach wasn't disclosed for three years, and Yahoo was in the process of selling to Verizon when the full scope was revealed.
Timeline
- 2013: State-sponsored attackers breach Yahoo — all 3 billion accounts affected
- 2014: A separate breach compromises 500 million accounts
- September 2016: Yahoo discloses the 2014 breach (2 years late)
- December 2016: Yahoo discloses the 2013 breach, initially claiming 1 billion accounts
- October 2017: Yahoo revises the 2013 breach to all 3 billion accounts
What Was Exposed
- Names, email addresses, phone numbers
- Dates of birth
- Hashed passwords (MD5 — a weak algorithm)
- Security questions and answers (some unencrypted)
- Forged authentication cookies (allowing access without passwords)
Impact
- Verizon reduced its acquisition price by $350 million (from $4.83B to $4.48B)
- Yahoo's CISO resigned
- The breach exposed the danger of security questions as authentication (many people reuse answers)
- Millions of credentials were sold on dark web marketplaces
- Credential stuffing attacks skyrocketed — hackers used Yahoo passwords to break into other accounts
Lessons
- Don't reuse passwords — the Yahoo breach fueled attacks on millions of other sites
- Security questions are not secure — treat them as secondary passwords (use random answers stored in a password manager)
- Companies hide breaches — Yahoo sat on the information for years
- MD5 is broken — any company still using it for password hashing is negligent
Related Terms
Credential Stuffing
An automated attack that uses stolen username/password pairs from one breach to try logging into other services, exploiting password reuse.
Data Breach
A security incident where protected, sensitive, or confidential data is accessed, stolen, or exposed by unauthorized individuals. Data breaches can result from hacking, insider threats, lost devices, or misconfigured systems.
How to Check If You've Been Hacked
Steps to determine if your accounts, devices, or personal information have been compromised in a data breach or security incident.
Identity Theft
The fraudulent use of someone's personal information — such as Social Security number, credit card details, or login credentials — to commit crimes or financial fraud.
Have more questions?
Use our guided flow to get the right next privacy step for Yahoo Data Breach.
Open Guided Flow