Yahoo admits it’s been hacked again, and 1 billion accounts were exposed

On December 14, Yahoo announced that after an investigation into data provided by law enforcement officials in November, the company and outside forensics experts have determined that there was in fact a previously undetected breach of data from over 1 billion user accounts. The breach took place in August 2013, and is apparently distinct from the previous mega-breach revealed this fall—one Yahoo claims was conducted by a "state-sponsored actor".

The information accessed from potentially exposed accounts "may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers," Yahoo's chief information security officer Bob Lord reported in the statement issued by the company. "The investigation indicates that the stolen information did not include passwords in clear text, payment card data, or bank account information. Payment card data and bank account information are not stored in the system the company believes was affected."

It's not clear whether the data provided by law enforcement to Yahoo is connected to samples offered on an underground site this past August, particularly since Yahoo still remains unsure of how the user data was spirited out of its systems in the first place. But the breach news doesn't end there.

Yahoo also had found through outside forensics experts that someone had found a way to forge web browser "cookies" that would allow them to gain access to users' accounts without logging in. "Based on the ongoing investigation," Lord said, "we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies…We have connected some of this activity to the same state-sponsored actor believed to be responsible for the data theft the company disclosed on September 22, 2016."

Lord said that Yahoo has informed users whose accounts were exposed by the forged cookies, and has "invalidated" the cookies and "hardened our systems to secure against similar attacks." As for users whose data may have been exposed in the newly-discovered billion-account breach, he said, "We are notifying potentially affected users and have taken steps to secure their accounts, including requiring users to change their passwords. We have also invalidated unencrypted security questions and answers so that they cannot be used to access an account…We continuously enhance our safeguards and systems that detect and prevent unauthorized access to user accounts."

Yahoo is in the midst of negotiating the details of an acquisition by Verizon, a $4.8 deal announced in July. After the September security revelation, it was reported that Verizon sought to reduce the value of its bid by $1 billion. Last week, Tim Armstrong—the CEO of AOL, which was previously acquired by Verizon—said that he was "cautiously optimistic" about the deal being closed soon.