Nearly three months after revealing that hackers in 2014 stole account information for at least 500 million users, Yahoo yesterday reported that an even larger breach affecting more than one billion accounts took place in 2013.
This latest hack by an unnamed and “unauthorized third party” was discovered while forensic experts were helping Yahoo analyze data that was provided to Yahoo by law enforcement authorities in November, according to the company. Yahoo said the 2013 attack is “likely distinct” from the 2014 breach the company reported in September.
Yahoo said it is notifying people potentially affected by the newly disclosed breach and requiring them to change their passwords. The company added that it also recently discovered that some of the accounts breached in 2013 could be accessed without passwords through the use of forged cookies, and has invalidated those forged cookies.
Believed to be the largest online security breach to date, the 2013 attack on Yahoo is likely to raise new questions for Verizon, currently set to close on its $4.83 billion purchase of Yahoo properties early next year. Verizon was reportedly notified of the 2013 hack “in the past few weeks,” and is said to be keeping all of its options open regarding the Yahoo deal, according to The Wall Street Journal.
Citing a person familiar with the matter, Bloomberg today reported that “Verizon Communications Inc. is exploring a price cut or possible exit from its $4.83 billion pending acquisition of Yahoo! Inc., after the company reported a second major e-mail hack affecting as many as 1 billion users.”
Payment, Bank Data ‘Not Affected’
Yahoo’s chief information security officer Bob Lord announced the discovery of the 2013 hack in a post yesterday on the company’s Tumblr blog. He said the breach could have revealed users’ names, email addresses, telephone numbers, dates of birth…