Yahoo data breach: what leaked and what to do
Yahoo (yahoo.com) had a data breach on 2012-07-11 affecting 453,427 accounts. Passwords were involved.
!Passwords leaked
Added to the catalogue 4 Dec 2013.
What leaked
- Email addresses
- Passwords
What happened
In July 2012, Yahoo! had their online publishing service "Voices" compromised via a SQL injection attack. The breach resulted in the disclosure of nearly half a million usernames and passwords stored in plain text. The breach showed that of the compromised accounts, a staggering 59% of people who also had accounts in the Sony breach reused their passwords across both services.
Description from Have I Been Pwned, in its words.
What to do
- Change the password on that service, and anywhere you used the same password. A password manager makes this painless.
- Turn on two-factor sign-in on that service and on your email.
- Warn staff: emails, texts or calls quoting leaked details are not proof the sender is genuine.
- If card or bank details leaked, watch statements and tell the bank; if identity documents leaked, consider a credit ban or alert.
Common questions
What leaked in the Yahoo breach?
Email addresses, Passwords
When did the Yahoo breach happen?
The breach date is 2012-07-11; it was added to the public catalogue on 2013-12-04.
What should I do if my staff used this service?
Change the password there and anywhere it was reused, turn on two-factor sign-in, and warn staff about emails quoting the leaked details.
Was a staff address in this breach?
Check one address free, no storage. Breach Watch checks every staff address after each new breach.