In 2014 Yahoo was hacked, although the hack is only just now being made public. The Internet company has confirmed that personal information, including names, telephone numbers, dates of birth and emails, as well as “unencrypted security questions and answers” were taken, and that this information related to 500 million users. The fact that the hack happened and the scale of the data breach have both been confirmed by the FBI, according to the BBC.
In an official statement, Yahoo says: “We have confirmed, based on a recent investigation, that a copy of certain user account information was stolen from our network in late 2014 by what we believe is a state-sponsored actor.” Although the emphasis is clearly on another country, the state in question has not been named.
And it adds: “The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation has found to be affected.” The only advice Yahoo provides to its users, which includes services to other provides such as British Telecom, is for users to change their passwords if they have not done so since 2014.
Rumors of the attack began to circulate in August 2016, when an unknown hacker called “Peace” attempted to sell information on 200 million Yahoo accounts. Yahoo did not confirm or deny the hack at this time.
The new information has led to a barrage of criticisms against Yahoo. For instance: why has it taken the company so long to go public? Why did the company not recommend to its users that they change their passwords sooner? If the hack is state sponsored, why has the country not been named?
Critics include U.S. Senator Mark Warner, who told The Guardian: “While its scale puts it among the largest on record, I am perhaps most troubled by news that this breach occurred in 2014, and yet the public is only learning details of it today.”
