Yahoo's breaches stayed hidden for three years

The story

In August 2013, attackers broke into Yahoo and took data on all three billion of its user accounts. In 2014, a separate attack took data on more than 500 million accounts.

The stolen data included names, email addresses, phone numbers, dates of birth and, in many cases, security questions and answers, some of them unencrypted.

Yahoo did not tell the public until September 2016, when it was in the middle of selling its main business to Verizon. It later admitted it had known about the 2014 intrusion at the time. The delay led to lawsuits, a fine from the US Securities and Exchange Commission, questions from Congress and complications for the sale. Four people were later charged over the 2014 breach.

Why it mattered

The Yahoo breaches are among the largest ever discovered. The years of silence did their own damage: the sale price of Yahoo’s business was cut, and the US Securities and Exchange Commission fined the company for not disclosing the breach in time. Waiting to tell people about a breach can cost more than the breach itself.

The lesson today

Security questions are a weak point because the answers do not change. Your mother’s maiden name or first school stays the same after a breach. Wherever you can, use multi-factor authentication instead, or give answers that are not true and keep them in a password manager. For businesses, the lesson is about response: having a plan for what to do and who to tell makes it easier to act quickly.