Yahoo! is expected to confirm its unwelcome distinction of being the victim of the largest data breach on record. A report has the tech giant is expected to disclose details of a hack that has affected some 200 million Yahoo users. 
 
 Yahoo! Inc., is preparing to confirm a “massive data breach” of its core service, one that could affect and expose ‘several’ hundred million user accounts. 
 
 Tech news site Recode broke the news, citing sources who noted the breach to be “widespread and serious”, with the likelihood of legal action and investigations led by the government. 
 
 The revelation would come at a time when Yahoo is the midst of a mega-acquisition by Verizon in a $4.8 billion deal and it remains to be seen if the deal could see repercussions due to the breach. 
 
 Earlier in August, Motherboard reported that a cybercriminal hacker who goes by the moniker “Peace” was advertising the sale of 200 million Yahoo accounts. The same hacker has previously sold large data dumps of breaches related to Myspace and LinkedIn on a dark web marketplace called the Real Deal. 
 
 While the lagging technology giant admitted that it was investigating the data breach, a Recode source confirmed that the number of users affected could be more than the 200 million advertised by Peace. 
 
 “It’s as bad as that,” said the Recode source. “Worse, really.” 
 
 The data trove reportedly contains Yahoo users’ usernames, scrambled passwords, birthdates and other information, likely dated from 2012. 
 
 Peace was hawking the alleged data of 200 million users for a relatively mere 3 bitcoins, around $1900 in value at the time. 
 
 Featured image from iStock/4×6. ||||| Yahoo is poised to confirm a massive data breach of its service, according to several sources close to the situation. The company was the victim of hacking that has exposed several hundred million user accounts. 
 
 While sources were unspecific about the extent of the incursion, since there is the likelihood of government investigations and legal action related to the breach, they noted that it is widespread and serious. 
 
 Earlier this summer, Yahoo said it was investigating a data breach in which hackers claimed to have access to 200 million user accounts and one was selling them online. “It’s as bad as that,” said one source. “Worse, really.” 
 
 The announcement, which is expected to come this week, also has possible larger implications for the $4.8 billion sale of Yahoo’s core business — which is at the core of this hack — to Verizon. The scale of the liability could bring untold headaches to the new owners. Shareholders are likely to worry that it could lead to an adjustment in the price of the transaction. 
 
 That deal is now moving to completion, but the companies cannot be integrated until it is approved by a number of regulatory agencies, as well as Yahoo shareholders. Representatives of Verizon and Yahoo started meeting recently to review the Yahoo business, so that the acquisition would run smoothly once complete. 
 
 But there’s nothing smooth about this hack, said sources, which became known in August when an infamous cybercriminal named “Peace” claimed on a website that he was selling credentials of 200 million Yahoo users from 2012 on the dark web for just over $1,800. The data allegedly included user names, easily decrypted passwords and personal information like birth dates and other email addresses. 
 
 At the time, Yahoo said it was “aware of the claim,” but the company declined to say if it was legitimate and said that it was investigating the information. But it did not issue a call for a password reset to users. Now, said sources, Yahoo might have to, although it will be a case of too little, too late. 
 
 The confirmation of such an extensive hack is another blemish on the record of CEO Marissa Mayer, a vaunted former Google exec who has presided over numerous declines in the business since she arrived four years ago. Her inability to turn Yahoo around or innovate any new products eventually led to the sale. 
 
 I reached out to Yahoo for comment and will update this post if I get a response (don’t wait up late for that!). ||||| Yahoo CEO Marissa Mayer. Getty/Kimberly White Yahoo is getting ready to confirm a huge, historic hack affecting 200 million users, Recode reports. 
 
 Back in August, Motherboard's Joseph Cox reported that 200 million apparent Yahoo user credentials were being sold on the dark web. At the time, the company's response was only that it was "aware of [the] claim." 
 
 But now Kara Swisher, one of the tech industry's most respected journalists, is reporting for Recode that Yahoo sources tell her the company is preparing to publicly confirm the hack. (Her sources did not confirm its exact size, only that it was "widespread and serious.") 
 
 Yahoo did not immediately respond to Business Insider's request for comment. 
 
 Motherboard was told by the hacker who held the data (and was selling it for 3 bitcoins, worth $1,860 at the time) that the breach was carried out in 2012 — and was never made public. Data included usernames, encrypted passwords, date-of-births, and some email addresses. 
 
 A spate of historic data breaches affecting millions of users have recently been coming to light, affecting companies including LinkedIn, MySpace, and Tumblr. If user passwords are unencrypted (or not encrypted properly), hackers can then use this login data to break into individual user accounts — and often, because people reuse passwords across multiple sites, the hackers can use the information to break into accounts on other sites as well. 
 
 We saw multiple high-profile demonstrations of this problem this summer, as celebrities and public figures including Mark Zuckerberg and Drake had their Twitter accounts broken into. Twitter wasn't hacked — but the victims had reused passwords that were also used on hacked websites. 
 
 This new attention on the alleged breach comes at an awkward time for Yahoo. The tech company is selling its core business to Verizon for $4.8 billion (£3.7 billion) after years of flagging fortunes. 
 
 There's nothing ordinary users can do to prevent these kinds of breaches, but using a strong, unique password on each website or service you have an account on (managing those passwords with a password-manager app if necessary) will help limit the damage. ||||| Yahoo (YHOO) on Thursday afternoon disclosed a security breach involving at least 500 million customers, but questions are being raised about whether the internet company should have moved sooner to protect users. 
 
 News that Yahoo would disclose the hack was reported Thursday by Recode, which cited several anonymous sources close to the situation. Those sources describe the breach as “widespread and serious,” while declining to elaborate because of possible government investigations and potential lawsuits. 
 
 In early August, tech site Motherboard reported that a hacker who goes by the moniker “Peace” was selling information, including user names, birth dates and scrambled passwords, from 200 million Yahoo accounts. 
 
 “Consumers should be not be reading in the news something Yahoo hasn’t told them,” said Susan Grant, director of consumer protection and privacy at the Consumer Federation of America. “They should be hearing this from Yahoo, not only that we had this problem -- but also about what to do.” 
 
 In confirming the attack on Thursday, Yahoo said user account information was stolen from the company’s network in late 2014 by what the company called a “state-sponsored actor.” The data may have included names, email addresses, phone numbers, dates of birth and passwords. 
 
 Yahoo initiated an internal probe following a report in July of a hacker selling 280 million user credentials on the black market, but found no evidence to substantiate the hacker’s claims, according to a source close to the company. A deeper review by the company’s security team found evidence a date theft occurred in 2014, the source said. 
 
 Yahoo declined comment as to why the company had not notified users earlier. 
 
 Like other companies, Yahoo is subject to data-breach notification laws in effect in 48 states that require companies to alert customers within specific periods of time that their information has been compromised. 
 
 “There are sometimes exceptions for notification when there are good reasons for law enforcement purposes for not revealing,” said Grant. But in Yahoo’s case the data loss has already been revealed, she noted. 
 
 A complicating factor, both for companies and customers, is that notification laws can be ambiguous. In Yahoo’s home state of California, for instance, the statute stipulates only that “The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement.” 
 
 Beyond changing their passwords, Grant advised Yahoo users concerned their information might be compromised to go the government site identitytheft.gov and follow the prompts on what it calls a recovery plan. 
 
 The reports come as Yahoo looks to close a deal to be acquired​ by telecommunications giant Verizon (VZ​), which agreed in July to buy its internet business for $4.8 billion. 
 
 “It doesn’t appear Yahoo had hard enough defenses, and with a merger you have to worry about even more sensitive information being vulnerable, Grant said. “When there’s more information that can be potentially there for the taking, it raises concerns about the adequacy of the security.” 
 
 “Within the last two days, we were notified of Yahoo’s security incident. We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact,” said a Verizon spokesperson. “We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities.” 
 
 AOL did not return requests for comment. ||||| A notorious cybercriminal is advertising 200 million of alleged Yahoo user credentials on the dark web, and the company has said it is “aware” of the hacker’s claims, but has not confirmed nor denied the legitimacy of the data. 
 
 On Monday, the hacker known as Peace, who has previously sold dumps of Myspace and LinkedIn, listed supposed credentials of Yahoo users on The Real Deal marketplace. Peace told Motherboard that he has been trading the data privately for some time, but only now decided to sell it openly. 
 
 “We are aware of a claim,” a Yahoo spokesperson told Motherboard in an email, before the data was made public. The company did not deny that the customer details were Yahoo users, despite being asked if it corresponded to the company's own records. 
 
 “We are committed to protecting the security of our users’ information and we take any such claim very seriously. Our security team is working to determine the facts. Yahoo works hard to keep our users safe, and we always encourage our users to create strong passwords, or give up passwords altogether by using Yahoo Account Key, and use different passwords for different platforms.” 
 
 A screenshot of the listing for the sale of the alleged hacked Yahoo data. 
 
 According to a sample of the data, it contains usernames, hashed passwords (created with md5 algorithm), dates of birth, and in some cases back-up email addresses. The data is being sold for 3 bitcoins, or around $1,860, and supposedly contains 200 million records from “2012 most likely,” according to Peace. Until Yahoo confirms a breach, however, or the full dataset is released for verification, it is possible that the data is collated and repackaged from other major data leaks. 
 
 Peace told Motherboard, “well fuck them they dont want to confirm well better for me they dont do password reset.” Many companies issue password resets to accounts affected by data breaches, or even preemptively in a case like this in which the provenance of leaked data is not entirely clear. 
 
 Motherboard obtained a very small sample of the data—only 5000 records—before it was publicly listed, and found that most of the two dozen Yahoo usernames tested by Motherboard did correspond to actual accounts on the service. (This was done by going to the login section of Yahoo, entering the email address, and clicking next; when the email address wasn’t recognised, it was not possible to continue.) 
 
 However, when Motherboard attempted to contact over 100 of the addresses in the sample set, many returned as undeliverable. “This account has been disabled or discontinued,” read one autoresponse to many of the emails that failed to deliver properly, while others read “This user doesn’t have a yahoo.com account.”
– Yahoo is confirming what Recode describes as a "widespread and serious" data breach affecting 500 million users. Yahoo blames "state-sponsored actors" for the personal data that was stolen in 2014 but only recently discovered to have been stolen, the AP reports. Yahoo had previously been expected to confirm an estimated 200 million users were affected. Motherboard spoke in August to a hacker known as "Peace” who claimed to be hawking data from 200 million Yahoo accounts on the dark web, per Business Insider. The hacker said the data—which includes usernames, passwords, security questions and answers, birth dates, phone numbers, and email addresses—was likely stolen in 2012. No such breach was ever made public. However, Yahoo said at the time that it was "aware of the claim" and was investigating. Confirmation of such a breach—which Hacked.com says could be "the largest data breach on record"—could now affect Yahoo's $4.8 billion sale to Verizon. Not only is it a pain for Verizon, but Yahoo shareholders will be concerned about a possible drop in the company's sale price. The sources tell Recode that government investigations and legal action in regards to breach are expected. In its confirmation of the breach, Yahoo suggested users change their passwords, assuming they haven't already done so since 2014.