Skip to main content

Yahoo’s 2013 data breach is worse than believed — 3 billion users were affected

In December 2016, Yahoo disclosed that its servers were hacked way back in 2013, compromising the sensitive personal data of around 1 billion users. On Tuesday, Yahoo’s new parent company, Verizon, confirmed that the initial estimate was a bit low — in fact, all Yahoo accounts were compromised in the 2013 hack. That’s 3 billion users, making it the largest data breach in history.

“Subsequent to Yahoo’s acquisition by Verizon, and during integration, the company recently obtained new intelligence and now believes, following an investigation with the assistance of outside forensic experts, that all Yahoo user accounts were affected by the August 2013 theft,” reads a statement from Verizon subsidiary Oath.

If you ever had a Yahoo account prior to 2013, now would be a good time to resecure all of your existing online accounts — particularly any that may have had contact with your Yahoo account. The security precautions Yahoo took in the aftermath of the original hack might protect current Yahoo users.

“In 2016, Yahoo took action to protect all accounts, including directly notifying impacted users identified at the time, requiring password changes, and invalidating unencrypted security questions and answers so that they could not be used to access an account. Yahoo also notified users via a notice on its website,” Oath’s statement says.

The original breach shook confidence in Yahoo’s ability to protect its users personal information, not only because of the scope of the data breach but because of how long it took for Yahoo to disclose that its users’ information had been compromised.

As a reminder, the original data breach in 2013 potentially exposed names, email addresses, telephone numbers, dates of birth, hashed passwords, as well as security questions and answers. Naturally, such a glut of personal information could be used in a variety of ways, not least of which would be to access other online accounts.

Yahoo was quick to point out what information wasn’t compromised, however.

“The investigation indicates that the information that was stolen did not include passwords in clear text, payment card data, or bank account information. Payment card data and bank account information are not stored in the system the company believes was affected,” the statement reads.

Even though payment data and bank account information wasn’t leaked, it could very well have been accessed with the treasure trove of personal information hackers successfully made off with. So it bears repeating, if you’ve ever had a Yahoo account, it’s time to change all your passwords. Again.

If you don’t already have one, now would be a good time to look into a password manager.

Editors' Recommendations

Jayce Wagner
Former Digital Trends Contributor
A staff writer for the Computing section, Jayce covers a little bit of everything -- hardware, gaming, and occasionally VR.
T-Mobile reveals it ended 2020 with data a breach
The T-Mobile logo on a smartphone.

T-Mobile’s new year is not off to the greatest of starts after the carrier revealed details of a security breach affecting some of its customers.

A message on T-Mobile’s website says that a recently identified security incident may have allowed hackers to steal customer data such as phone numbers, number of lines subscribed to on an account, and call-related information collected as part of the normal operation of its wireless service.

Read more
Time is running out to file a claim in Yahoo data breach settlement
how to file a claim yahoo data breach settlement deadline

If you were affected by the Yahoo data breach between 2012 and 2016, you only have until July 20 to file a claim. 

People affected by the breach could be eligible for free credit monitoring services and/or up to $100.The money is part of a $117.5 million class-action settlement. After deducting for services and expenses from lawyers, that leaves about $85 million to pay out claims. 

Read more
Hackers are trying to sell a haul of more than 73 million user records
Hands on a laptop.

More than 73 million user records stolen from across a number of online services are being offered for sale on the dark web by hacker group ShinyHunters, according to ZDNet.

Affected services include online dating app Zoosk (30 million user records), printing service Chatbooks (15 million), food delivery service Home Chef (8 million), online marketplace Minted (5 million), and U.S. news site Star Tribune (1 million).

Read more