{"id":67144,"date":"2016-12-15T08:33:48","date_gmt":"2016-12-15T16:33:48","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=67144"},"modified":"2025-08-19T09:22:42","modified_gmt":"2025-08-19T16:22:42","slug":"another-yahoo-breach","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/another-yahoo-breach\/","title":{"rendered":"A Billion Users Affected by Latest Yahoo Breach"},"content":{"rendered":"

<\/u>Yahoo Inc. just revealed its second major breach<\/a> in a year. Its first disclosure, taking place in September, claimed that cybercriminals stole data on more than 500 million users<\/a>. Its second disclosure, taking place on Wednesday, announced that cybercriminals stole data on more than a billion<\/a> of the service\u2019s users. The criminals, essentially, stole the details of almost every Yahoo account.<\/p>\n

The stolen data includes names, email addresses, telephone numbers, dates of birth, hashed passwords (more on this in a moment) and encrypted and unencrypted security questions and answers. The cybercriminals did not compromise any clear-text (normal text, like what you\u2019re reading now) passwords, banking information or payment card data, according to Yahoo. The company has not been able to identify how the data was stolen, though it does say it believes the intrusion began in August 2013.<\/p>\n

And that\u2019s not all. While Yahoo did take the precaution of hashing passwords\u2014essentially jumbling passwords so much they become unrecognizable\u2014the cybercriminals behind the attack can still bypass a password challenge, thanks to forged cookies. Cookies, in internet lingo, are a type of tracker stored on each user\u2019s computer. This tracker contains information relevant to a particular website or service and the user it\u2019s assigned to, allowing that user to enjoy easier access to services and more.<\/p>\n

Cybercriminals, however, can use forged cookies to trick Yahoo\u2019s service into thinking a user is accessing their account when it\u2019s actually the criminal in question. Yahoo has invalidated these cookies and is in the process of notifying users affected by this technique. The forged cookies are a bigger problem than it immediately seems, since it suggests a hostile party had access to the company\u2019s proprietary code\u2014a major issue for any organization dependent on software for profit<\/a>.<\/p>\n

Protect Yourself from Data Breach<\/h2>\n

Regardless, there are steps you should immediately take if you ever find yourself involved in a massive data breach like this one:<\/p>\n