Yahoo Admits That Its Entire User Database Was Hacked in 2013

Last month, Yahoo provided more information on the major hack against the company's users that took place four years ago. According to the latest announcement concerning that issue, the attack affected much more users than admitted in the previous statements of the company, and the released in 2016 numbers of exposed user accounts were largely underestimated.

Yahoo came out in September this year with the latest results of the still running investigations. The analysis now shows that the hack did not affect 500 million, or 1 billion as previously announced, but around 3 billion user accounts were actually exposed to malicious actions and data theft. That information means that practically the entire user database of the company at that time was affected by the breach. These last findings were made with the help of external forensic experts. The company also claims that it has already taken all measures to protect its currently active user accounts after the August 2013 breach was announced in December last year. In connection to that, it is recommended that all Yahoo users who have not yet changed their passwords should do this as soon as possible.

However, as the breach happened over fours ago, it looks like it is way too late to prevent any damage that the attackers could have done on the users' data. It is also highly questionable whether Yahoo's behavior regarding that hack was fair towards the company's customers, announcing it years later. Despite these facts, the company seems still to believe to have done its best to protect the accounts. Furthermore, it claims that the attackers had access to its database through a stolen Yahoo source code, and the breach did not expose any data like bank accounts, passwords, or credit card numbers, which would have put the attack on an entirely different level.

Yahoo initially admitted the hack in September 2016, saying back then that only 500 million user accounts were exposed to unauthorized access. Without providing any specific details, it made implications that it was a "state-sponsored" attack. However, Yahoo mentioned no suspected country or hacking group that could have conducted the breach. In an update in December, the company provided evidence that the actual number of breached accounts was twice as large – 1 billion, yet as it turns out now, that was not the final figure either.