Earlier this week, Yahoo announced that the data breach reported earlier this year did not impact 200+ million users as originally thought. The reality is that up to three billion accounts may be compromised --which is essentially Yahoo's entire customer base. What does this news change? How does it impact you? What should you do now? Let's walk through the answers to those questions.
What changed: In July 2016, Yahoo officially released information about a data breach that it believed involved the personal information on 200-400 million users, or more. This week, it notified the world that its original estimate was incorrect. In reality, up to three billion users were in the data files that the attackers have stolen, which means that nearly everyone who's used Yahoo services is going to be impacted by this situation.
How does it impact you?
The data stolen includes (but isn't limited to):
What this means to the average user is that the hackers probably have your password, and they do have everything they need to get into your account. Even if your password wasn't decrypted yet (and a large number of them have been already), an attacker could take all the remaining information and pretend to be you in order to get a "password reset" from Yahoo and gain access to anything you have in your Yahoo account and any services.
Also, since the passwords have already been decrypted for a lot of accounts (200 million known to be available as plain text just so far), hackers can break into any site where you used the same username and password or email and password combination without trying to gain access via password reset procedures.
As they have your name, username, email, and security questions and answers; someone can impersonate you and get multi-factor authentication disabled on your Yahoo account. Essentially, they call in, tell the phone representative that they've lost their phone or changed their number, answer the security questions and provide your home address, and get the MFA protection removed or changed to their own phone.
What you should do now
If you have ever used a Yahoo service where you had to log in, then immediately do the following:
The first step makes sure that if an attacker does get your credentials from this breach, they cannot use them on any other site. Step 2 makes sure you're automatically protected from getting hacked across multiple sites should another site or service suffer an attack like this in future.
While you cannot stop this kind of attack from happening (unless you work for Yahoo in its digital security division), taking these steps can lock an attacker out of your accounts on Yahoo and other sites.
Finally, after every major breach like this, scammers begin to blast out emails and phone calls to try to get people who may not have been breached to give up secure information. Don't click on links in emails that look like they're from Yahoo or give control of your computer to a caller. Instead, if you think the email might be legitimate, go to Yahoo manually in your web browser and then find the information you need in your profile.
Stay safe, stay sane, and start now to protect your online identity from being compromised due to one site letting information get away from them.
Mike DeNapoli, is a professional nerd and Systems Engineer at SecureAuth. Mike has been in information technology both as a hands-on engineer and a pre-sales engineer for over 20 years; having worked for both startups and international firms during that time. Previous to SecureAuth, Mike has worked with Stratoscale – producers of the Symphony platform, which provides AWS-compatible on-prem private cloud software. Prior to Stratoscale, he spent 14 years at Vision Solutions/Double-Take Software; where he worked as a pre-sales engineer and architect in both High Availability and Datacenter Transformation solutions.