Yahoo Email Account Passwords Stolen - And Their CEO Marissa Mayer Is A FLOP

[HallOates]

<iframe src="//www.youtube.com/embed/nTOV9vFN19o?rel=0" allowfullscreen="" width="560" frameborder="0" height="315"></iframe>

Yahoo Email Account Passwords Stolen

Published on Jan 31, 2014

Usernames and passwords of some of Yahoo's email customers have been stolen and used to gather personal information about people those Yahoo mail users have recently corresponded with, the company said. (Jan. 31)

 

[HallOates]

How many Yahoo email passwords have REALLY been stolen? Firm admits 'coordinated attack' - but refuses to say how many of its 237 million accounts are affected

• Usernames and passwords of its email customers have been stolen and used to access accounts in a 'coordinated attack'
  
• Users affected have been emailed or sent an SMS
  
• Yahoo is the second-largest email service worldwide, after Google's Gmail
• Company 'working with federal law enforcement' on the issue
  

By Mark Prigg
PUBLISHED: 00:02 GMT, 31 January 2014 | UPDATED: 02:47 GMT, 31 January 2014

Yahoo has admitted that usernames and passwords of its email customers have been stolen and used to access accounts - but has refused to reveal how many.

Yahoo is the second-largest email service worldwide, after Google's Gmail, according to the research firm comScore.

There are 273 million Yahoo mail accounts worldwide, including 81 million in the U.S.

Marissa Mayer's firm has admitted to a major hack attack - but refused to reveal how many users have been affected.

ARE YOU AFFECTED?

The firm said it would contact affected users, but has not revealed how many are thought to be at risk.

'We are resetting passwords on impacted accounts and we are using second sign-in verification to allow users to re-secure their accounts,' it said.

'Impacted users will be prompted (if not, already) to change their password and may receive an email notification or an SMS text if they have added a mobile number to their account..

Yahoo admitted in a blog post on its breach that 'The information sought in the attack seems to be names and email addresses from the affected accounts' most recent sent emails.'

However, the firm did not respond to emails or phone calls from MailOnline asking it to clarify the scale of the breach.

Yahoo said it believes the usernames and passwords weren't collected from its own systems, but from a third-party database.

It is not clear why a third-party database would have information on Yahoo accounts.

Yahoo said it is resetting passwords on affected accounts and has 'implemented additional measures' to block further attacks.

'Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise,' the firm said.
'We have no evidence that they were obtained directly from Yahoo’s systems.

'Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts.

'The information sought in the attack seems to be names and email addresses from the affected accounts’ most recent sent emails.'

'We regret this has happened and want to assure our users that we take the security of their data very seriously.'

That could mean hackers were looking for additional email addresses to send spam or scam messages.

Yahoo admitted in a blog post on its breach that 'The information sought in the attack seems to be names and email addresses from the affected accounts' most recent sent emails.'

By grabbing real names from those sent folders, hackers could try to make bogus messages appear more legitimate to recipients.

The bigger danger: access to email accounts could lead to more serious breaches involving banking and shopping sites.

That's because many sites use email to reset passwords.

Hackers could try logging in to such a site with the Yahoo email address, for instance, and ask that a password reminder be sent by email.

A TARGETTED ATTACK

Target has revealed that a sales assistant's stolen credentials helped cyber criminals pull off a massive theft of customer data during the Christmas shopping season last year.

Around 40 million credit and debit card details and 70 million other private records were stolen by hackers accessing the US retailers' payment system using an unidentified vendor's details.

The disclosure of how the criminals were able to pull off the crime comes as U.S. Attorney General Eric Holder confirmed that the Department of Justice was investigating the massive hacking at Target.

The breach is the second problem for Yahoo's mail service in two months.

In December, the service suffered a multi-day outage that prompted Yahoo CEO Marissa Mayer to issue an apology.

The company would not comment beyond the information in its blog post.

It said it is working with federal law enforcement.