In December 2016, Yahoo disclosed that its servers were hacked way back in 2013, compromising the sensitive personal data of around 1 billion users. On Tuesday, Yahoo’s new parent company, Verizon, confirmed that the initial estimate was a bit low — in fact, all Yahoo accounts were compromised in the 2013 hack. That’s 3 billion users, making it the largest data breach in history.
“Subsequent to Yahoo’s acquisition by Verizon, and during integration, the company recently obtained new intelligence and now believes, following an investigation with the assistance of outside forensic experts, that all Yahoo user accounts were affected by the August 2013 theft,” reads a statement from Verizon subsidiary Oath.
If you ever had a Yahoo account prior to 2013, now would be a good time to resecure all of your existing online accounts — particularly any that may have had contact with your Yahoo account. The security precautions Yahoo took in the aftermath of the original hack might protect current Yahoo users.
“In 2016, Yahoo took action to protect all accounts, including directly notifying impacted users identified at the time, requiring password changes, and invalidating unencrypted security questions and answers so that they could not be used to access an account. Yahoo also notified users via a notice on its website,” Oath’s statement says.
The original breach shook confidence in Yahoo’s ability to protect its users personal information, not only because of the scope of the data breach but because of how long it took for Yahoo to disclose that its users’ information had been compromised.
As a reminder, the original data breach in 2013 potentially exposed names, email addresses, telephone numbers, dates of birth, hashed passwords, as well as security questions and answers. Naturally, such a glut of personal information could be used in a variety of ways, not least of which would be to access other online accounts.
Yahoo was quick to point out what information wasn’t compromised, however.
“The investigation indicates that the information that was stolen did not include passwords in clear text, payment card data, or bank account information. Payment card data and bank account information are not stored in the system the company believes was affected,” the statement reads.
Even though payment data and bank account information wasn’t leaked, it could very well have been accessed with the treasure trove of personal information hackers successfully made off with. So it bears repeating, if you’ve ever had a Yahoo account, it’s time to change all your passwords. Again.
If you don’t already have one, now would be a good time to look into a password manager.
