Third Times a Charm For Yahoo Data Breach
It’s no shock to hear news about levels of security of Yahoo associated accounts, the decline of the company, once at the forefront of the internet age, has been well documented. Before being acquired by Verizon, Yahoo had gained an unfortunate reputation following a number of high-profile data breaches that had affected user accounts.
In 2013, Yahoo suffered a large-scale data breach that resulted in customer details including email addresses and passwords being stolen by cyber-criminals. In 2014, the extent of this breach was revealed to be some 500 million accounts, a hefty number. Fast forward 2-years, it’s 2016 and in the midst of takeover rumours Yahoo confirm the number of accounts breached in the 2013 attack was double the 500 million previously stated, actually standing at 1 billion. Come 2017 and Oath, the group Yahoo now falls under as part of the Verizon group of companies, brings to light “new intelligence”. This intelligence confirms the worst; the 2013 Yahoo data breach exposed all 3 billion accounts to hackers.
3 billion email addresses, and the rest…
The data exposed to hackers, included full names, addresses and phone numbers, along with weakly hashed passwords. That’s 3 billion accounts completely exposed and the personal data for millions, if not billions, of people available to cyber-criminals. This data could have been available on the dark-web for 4 years at this point and despite Yahoo and Verizon’s commitments to improve security, the damage is already done.
In a statement, Chief Information Security Officer for Verizon, Chandra McMahon has said:
“Verizon is committed to the highest standards of accountability and transparency, and we proactively work to ensure the safety and security of our users and networks in an evolving landscape of online threats… Our investment into Yahoo is allowing the team to continue to take significant steps to enhance their security, as well as benefit from Verizon’s experience and resources.”
The takeover of Yahoo in 2016 was big news and following the now out-dated revelation that 1 billion accounts had been hacked, Yahoo’s valuation fell from $4.8 billion to $4.5 billion, a figure which would have been significantly less had the true extent of the breach been revealed.
How to use breached information
The savvy cyber-criminal could find many uses for the information gained by the Yahoo breach. The data negates the need for any phishing scams as passwords were leaked, this opens up the possibility of identity and financial fraud and should be a worry to any end-user effected – or it should have been 4 years ago at least.
Of course, for those criminals to make some money from their exploits selling the data on could be lucrative. But it is unlikely that this would ever generate enough funds to retire on and it’s not like there’s another way to extort money from this data, is there?
The rise of Ransomware
In 2017, hearing the word Ransomware used in relation to cyber-security threats and criminal activity is no shock to anybody. Ransomware and other types of malware are seen as a quick payday for cyber-criminals and although they’ve been around for a long time their rise to prominence has in many cases been reported to have started in, 2013. Coincidence, maybe, however ransomware is often spread via email, either as an attachment or using a malicious link, and having 3 billion valid email addresses to target would mean a payday for any cyber-criminal.
What to do if you’ve been affected by a breach
It’s difficult to assess the potential damages done by a data breach without knowing if your data has been breached; if you were a user of Yahoo services in 2013 you have been. Website, have I been pwned is a good place to search to find out if your email address has been breached and any associated information that may have been stolen with it.
Updating security settings and ensuring two-factor authentication is turned on, is an important place to start to help secure accounts. It is important not to simply delete accounts and they are then open to reactivation by anyone.
In the case of the Yahoo breach, it is likely that much of the damage to come from the loss of data has already been done. 4-years on, and bearing in mind some of the breaches making headlines recently, it is likely that hackers have updated email addresses to target and details to exploit value from.
Securing and protecting your data against a data breach can be near on impossible and is often out of your control. However simple changes such as using secure passwords and two-factor authentication can help protect accounts. Further to this, keeping admin accounts and general accounts separately can prevent sensitive information and systems falling into the hands of cyber-criminals if an account is hacked or breached. Data backup is vital to preventing data loss (such as deletion, accidental or not), and can help recover data in this case, although it is not suitable for stopping a data breach.