Yahoo Breaches: 3 Billion Accounts, Forged Cookies and FSB-Hired Hackers

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Yahoo suffered the largest data breaches in internet history. An August 2013 attack hit all 3 billion accounts, a figure Yahoo did not fully admit until October 2017, and a late 2014 breach exposed more than 500 million accounts, which Yahoo knew of in 2014 but disclosed only in September 2016. Attackers took names, email addresses, phone numbers, birth dates and security questions, some stored in plain text, and many passwords were hashed with the weak MD5 algorithm rather than bcrypt. Worse, they stole the cryptographic keys Yahoo used to generate login cookies and forged cookies to enter 32 million accounts in 2015 and 2016 without passwords. Inside Yahoo, CEO Marissa Mayer reportedly clashed with security chief Alex Stamos, hired in 2014 after the Snowden leaks, and denied his team the money and engineers they requested; he left in 2015.

In June 2016 a hacker offered 200 million alleged Yahoo accounts on the darknet market The Real Deal. On September 9, 2016 Yahoo told the SEC it knew of no breaches, then 13 days later disclosed the 2014 hack. A 2017 U.S. indictment charged FSB officers Dmitry Dokuchaev and Igor Sushchin, FBI most-wanted hacker Alexsey Belan, and Canadian Karim Baratov. Belan copied the 500-million-account database and also searched mail for gift card codes, while Baratov used the stolen data to break into 80 non-Yahoo accounts for the FSB. Verizon cut its purchase price by $350 million to $4.48 billion when the deal closed in June 2017, and the leftover company, Altaba, paid a $35 million SEC fine in 2018 for failing to disclose the breach to investors.

• Baratov pleaded guilty, received five years in federal prison and a $2.25 million fine, and published a memoir called Disconnected in 2023.
• A federal judge rejected a $50 million class settlement for lack of transparency and high lawyer fees; the parties settled in 2019 for $117.5 million.
• German cybersecurity agencies advised citizens to stop using Yahoo, and the UK Information Commissioner's Office fined the British branch 250,000 pounds.
• Yahoo's general counsel resigned, and Mayer lost a $12 million bonus and stepped down when the Verizon sale closed.
• Congressional testimony says the perpetrators of the 3 billion account 2013 breach remain unknown.