The Yahoo breaches (2013 and 2014)

What happened

Yahoo disclosed two enormous breaches in 2016, while it was in the middle of selling its core internet business to Verizon:

• September 2016: Yahoo said information from at least 500 million accounts had been stolen in late 2014.
• December 2016: Yahoo announced a separate, earlier breach from August 2013, initially estimated at more than one billion accounts.
• October 2017: after the sale, the company revised the 2013 figure to all of the roughly three billion Yahoo accounts that existed at the time.

That made it the largest known breach of user accounts up to that point. The long gap between the thefts and their disclosure became as much of a story as the breaches themselves.

What was taken and how it worked

The stolen data included names, email addresses, phone numbers, dates of birth, hashed passwords and, in some cases, security questions and answers. Yahoo said payment card and bank data were not stored in the affected systems.

Two technical details explain why this mattered:

• Weak password hashing. Websites should not store passwords directly; they store a scrambled "hash". Yahoo said most passwords in the 2013 data were hashed with MD5, an old, fast algorithm. Fast hashes are easier to crack by trying billions of guesses, so many weaker passwords could be recovered. Modern practice uses deliberately slow algorithms such as bcrypt, scrypt or Argon2.
• Security questions. Some questions and answers were stored unencrypted. Answers like a mother's maiden name or first school do not change, so once leaked they stay leaked.

Yahoo also later reported that attackers had forged authentication cookies, which can let someone access an account without a password at all.

Impact

Verizon completed its purchase in 2017 but negotiated the price down by $350 million because of the breaches. In 2018, the US Securities and Exchange Commission fined the remaining company, Altaba, $35 million for failing to tell investors about the 2014 breach in a timely way, the first such penalty of its kind. Class-action lawsuits by users ended in a settlement as well.

For users, the biggest risk was credential reuse. Many people used the same email and password combination at banks, shops and social networks, so the stolen data fueled credential stuffing attacks elsewhere for years.

What defenders learned

• Disclosure delays are costly. Regulators and investors now expect companies to assess and report material incidents promptly.
• Password storage matters. Using slow, salted hashing turns a breach of password data from a disaster into a manageable problem.
• Security questions are weak. Many services have moved away from them in favor of two-factor authentication and passkeys.
• Security teams need authority. Reporting after the breaches suggested internal security warnings had struggled for attention and budget.

What it means for you

If you had a Yahoo account at any point before 2014, assume its data was exposed. Practical steps:

• Check your email addresses at Have I Been Pwned to see which known breaches include them.
• Use a unique password for every site, stored in a password manager.
• Treat security question answers like passwords: give random answers and store them in your password manager.
• Turn on two-factor authentication on your email first, because email is the reset key for everything else.
• Close accounts you no longer use. Old, forgotten accounts are still breach targets.