Half-A-Billion Reasons To Not Use Free E-mail

What businesses and individuals should learn from the Yahoo! breach.

- Mike Chapple

On September 26, 2016, Yahoo! announced to the world that they were the victim of the largest systematic account compromise in the history of the Internet. Attackers managed to penetrate Yahoo!’s network as early as 2014 and steal account information belonging to more than 500 million Yahoo! users.

News of the breach at Yahoo! rocked the cybersecurity world as use of the service is so widespread, ranging from hosting personal e-mail accounts on the Yahoo.com domain to managing thousands of fantasy football, baseball, and basketball leagues on their servers, and hosting millions of photographs through their Flickr service.

Indeed, it’s hard to imagine an American Internet user who hasn’t had some need to create a Yahoo! account over the past decade.

The not-usual suspects

In their announcement of the attack, Yahoo! revealed that the attackers walked away with a treasure trove of information. They didn’t tell individual users what information was stolen about their account but admitted that the theft included full names, e-mail addresses, telephone numbers, birth dates, and the answers to security questions.

That’s more than enough information to wage an identity theft attack against Yahoo! users and access accounts belonging to those users on Yahoo! and other services. While users can’t unring the proverbial bell and retrieve their stolen information, they should presume that this information was compromised and take immediate actions to protect themselves online.

Yahoo! described the attack as coming from a source that they “believe is a state-sponsored actor.” Without naming a specific country, Yahoo! is alleging that the attack comes from what cybersecurity professionals call an advanced persistent threat (APT).