Yahoo officials confirmed that an older file from the Yahoo Voices (formerly Associated Content) was stolen July 12 by hackers, allowing them to get their hands on more than 400,000 user credentials.
Of that amount, less than 5 percent of the Yahoo accounts had valid passwords, the company told eWEEK. Besides Yahoo email addresses, the list also included email addresses for Gmail, Hotmail, AOL and other services. Users of the Yahoo Contributor Network can sign up using their Google or Facebook IDs, which accounts for the various emails listed.
"We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo users and notifying the companies whose users’ accounts may have been compromised," a spokesperson said. "We apologize to affected users. We encourage users to change their passwords on a regular basis and also familiarize themselves with our online safety tips at security.yahoo.com."
The breach occurred courtesy of a group of hackers known as D33Ds Company, which posted a text file with the information online and said they used union-based SQL injection to swipe the information.
"We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat," D33Ds said in a message accompanying the leaked data. "There have been many security holes exploited in Web servers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage."
This is definitely a teachable moment on how not to store passwords in databases, said Marcus Carey, security researcher with Rapid7.
"This should be Application Development 101 at this point not to store passwords in clear text," Carey said.
Ron Gula, CEO and CTO of Tenable Network Security, agreed, noting that if the compromised file had only contained encrypted passwords, the hackers may not have realized what they had obtained.
"As with any type of social network service, if you reuse a password among many different sites, hackers may attempt to reuse these for other sites, such as your bank’s Website," he said. "Yahoo is taking the right steps to fix and close this issue and notify their customers."
The Yahoo breach comes on the back of reports earlier this week of a leak affecting social networking site Formspring, which reported that 420,000 password hashes belonging to Formspring users had been posted to a hacking forum.
To read the original eWeek article, click here: Yahoo Confirms 400,000 Passwords Stolen in Hack
Feeling stuck in self-doubt?
Stop trying to fix yourself and start embracing who you are. Join the free 7-day self-discovery challenge and learn how to transform negative emotions into personal growth.
