2014Data breachEspionage
Yahoo account breach
2014, disclosed 2016
Attackers broke into Yahoo's network in 2014, stole data from user accounts and gained the ability to forge cookies to access accounts without passwords. The breach was disclosed publicly in 2016. In 2018 the US Securities and Exchange Commission charged Yahoo's successor company over its delayed disclosure to investors.
- Victim
- Yahoo and its users
- Sector
- Technology
- Public attribution
- In 2017 the US Department of Justice charged two officers of Russia's FSB and two criminal hackers over the 2014 intrusion.
Impact
The US Department of Justice said the intrusion affected at least 500 million Yahoo accounts. The SEC settlement with Altaba, formerly Yahoo, included a 35 million US dollar penalty.
Root cause
A long-running intrusion that reached user databases and the systems used to mint authentication cookies, combined with slow escalation and disclosure.
Lessons learned: the controls it teaches
- Protect authentication and session-signing systems as tier-0 assets.
- Escalate confirmed breaches to leadership and disclose them as required.
- Invalidate sessions and rotate keys after a compromise of authentication systems.