Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Yahoo breach means hackers had three years to abuse user accounts

Michael Kan | Dec. 16, 2016
Elite hackers-for-hire or state-sponsored actors may have been involved, according to experts

Security researchers are disturbed it took Yahoo three years to discover that details of over 1 billion user accounts had been stolen back in 2013.

It means that someone -- possibly a state-sponsored actor -- had access to one of the largest email user bases in the world, without anyone knowing. The stolen database may have even included information on email ids of U.S. government and military employees.

“It is extremely alarming that Yahoo didn’t know about this,” said Alex Holden, chief information security officer with Hold Security.

Yahoo said back in November it first learned about the breach when law enforcement began sharing with the company stolen data  that had been provided by a hacker. At the time, the company was already dealing with a separate data breach, reported in September, involving 500 million user accounts.

However, this hacker was apparently sitting on another mother lode of stolen Yahoo data, but it's still unclear how the theft occurred. 

Holden, who investigates online black markets, said there was always chatter among underground dealers that someone had made away with a massive trove of information from the internet firm.

“Hackers allegedly had small samples, but they had never seen the full data set,” Holden said.

But the stolen data never appeared to be widely circulated to make a major profit, he said. It suggests that state-sponsored hackers may have been behind the breach, and wanted to keep the data secretly to themselves.  

“This information would have been distributed widely if cyber criminals were involved,” Holden said. “But right now, that seems not to be the case, even two or three years later.”

Private security firm InfoArmor may have actually discovered details about the Yahoo data breach earlier this year. In September, the company claimed it had found a stolen database allegedly belonging to Yahoo that was obtained from elite hackers-for-hire.

Yahoo, however, didn’t comment on the company’s finding, making it unclear if the data was legitimate.  

InfoArmor has claimed that a hacking team called “Group E,” likely out of Eastern Europe, breached Yahoo and sold the data in three private deals. At least one of the buyers was a state-sponsored actor, said Andrew Komarov, InfoArmor's chief intelligence officer, in an email on Wednesday.

The security firm has shared its findings with law enforcement agencies in the U.S., U.K., Australia and Europe. It said the stolen database it found also has information relating to over 150,000 U.S. government and military employees. Backup email addresses included in the discovered dump contain .gov and .mil domain names, said Komarov, who called the Yahoo breach a "matter of national security."

 

1  2  Next Page 

Sign up for CIO Asia eNewsletters.