Yahoo 2013 Data Breach

What happened

Hackers breached Yahoo's servers in August 2013 and compromised the account information for all 3 billion users. The stolen data included names, email addresses, telephone numbers, dates of birth, hashed passwords, and in some cases, encrypted or unencrypted security questions and answers. The breach was not publicly disclosed until December 2016, initially estimated at 1 billion accounts before being revised to all 3 billion in October 2017.

Technical mechanism

The specific technical mechanism of the initial 2013 intrusion remains undisclosed or undetermined, though Yahoo's subsequent 2014 breach involved forged cookies allowing attackers to access accounts without passwords. The compromised passwords in 2013 were protected primarily by bcrypt, with some older accounts using MD5.

Why it matters

The 2013 Yahoo breach remains the largest single data breach in history by number of accounts affected, demonstrating the systemic risk of centralized consumer data storage and the potential for multi-year delays in breach discovery and disclosure.

Impact

The breach exposed account information associated with all approximately 3 billion Yahoo accounts that existed in 2013. Yahoo required password changes, invalidated unencrypted security questions and answers, and continued notifying affected users after later forensic review expanded the known scope.

Response

Upon public disclosure in 2016, Yahoo required users to change passwords and invalidated unencrypted security questions. The company faced intense regulatory scrutiny, executive resignations, and lawsuits.

Defensive lessons

• Implement robust encryption for all stored sensitive data, including security questions
• Maintain comprehensive network monitoring to detect massive data exfiltration
• Establish and enforce rapid incident disclosure protocols

Evidence register

1. U.S. Securities and Exchange Commission — Yahoo Provides Notice to Additional Users Affected by Previously Disclosed 2013 Data Theft (verified)