Yahoo! is expected to confirm its unwelcome distinction of being the victim of the largest data breach on record. A report has the tech giant is expected to disclose details of a hack that has affected some 200 million Yahoo users. 
 
 Yahoo! Inc., is preparing to confirm a “massive data breach” of its core service, one that could affect and expose ‘several’ hundred million user accounts. 
 
 Tech news site Recode broke the news, citing sources who noted the breach to be “widespread and serious”, with the likelihood of legal action and investigations led by the government. 
 
 The revelation would come at a time when Yahoo is the midst of a mega-acquisition by Verizon in a $4.8 billion deal and it remains to be seen if the deal could see repercussions due to the breach. 
 
 Earlier in August, Motherboard reported that a cybercriminal hacker who goes by the moniker “Peace” was advertising the sale of 200 million Yahoo accounts. The same hacker has previously sold large data dumps of breaches related to Myspace and LinkedIn on a dark web marketplace called the Real Deal. 
 
 While the lagging technology giant admitted that it was investigating the data breach, a Recode source confirmed that the number of users affected could be more than the 200 million advertised by Peace. 
 
 “It’s as bad as that,” said the Recode source. “Worse, really.” 
 
 The data trove reportedly contains Yahoo users’ usernames, scrambled passwords, birthdates and other information, likely dated from 2012. 
 
 Peace was hawking the alleged data of 200 million users for a relatively mere 3 bitcoins, around $1900 in value at the time. 
 
 Featured image from iStock/4×6. ||||| Yahoo CEO Marissa Mayer. Getty/Kimberly White Yahoo is getting ready to confirm a huge, historic hack affecting 200 million users, Recode reports. 
 
 Back in August, Motherboard's Joseph Cox reported that 200 million apparent Yahoo user credentials were being sold on the dark web. At the time, the company's response was only that it was "aware of [the] claim." 
 
 But now Kara Swisher, one of the tech industry's most respected journalists, is reporting for Recode that Yahoo sources tell her the company is preparing to publicly confirm the hack. (Her sources did not confirm its exact size, only that it was "widespread and serious.") 
 
 Yahoo did not immediately respond to Business Insider's request for comment. 
 
 Motherboard was told by the hacker who held the data (and was selling it for 3 bitcoins, worth $1,860 at the time) that the breach was carried out in 2012 — and was never made public. Data included usernames, encrypted passwords, date-of-births, and some email addresses. 
 
 A spate of historic data breaches affecting millions of users have recently been coming to light, affecting companies including LinkedIn, MySpace, and Tumblr. If user passwords are unencrypted (or not encrypted properly), hackers can then use this login data to break into individual user accounts — and often, because people reuse passwords across multiple sites, the hackers can use the information to break into accounts on other sites as well. 
 
 We saw multiple high-profile demonstrations of this problem this summer, as celebrities and public figures including Mark Zuckerberg and Drake had their Twitter accounts broken into. Twitter wasn't hacked — but the victims had reused passwords that were also used on hacked websites. 
 
 This new attention on the alleged breach comes at an awkward time for Yahoo. The tech company is selling its core business to Verizon for $4.8 billion (£3.7 billion) after years of flagging fortunes. 
 
 There's nothing ordinary users can do to prevent these kinds of breaches, but using a strong, unique password on each website or service you have an account on (managing those passwords with a password-manager app if necessary) will help limit the damage. ||||| Now playing: Watch this: 500 million Yahoo accounts stolen 
 
 Hackers swiped personal information associated with at least a half billion Yahoo accounts, the internet giant said Thursday, marking the biggest data breach in history. 
 
 The hack, which took place in 2014, revealed names, email addresses, phone numbers, birth dates and, in some cases, security questions and answers, Yahoo said in a press release. Encrypted passwords, which are jumbled so only a person with the right passcode can read them, were also taken. 
 
 The internet pioneer, which is in the process of selling itself to Verizon, said it's "working closely" with law enforcement. It called the hackers a "state-sponsored actor," though it didn't identify a country behind the breach. 
 
 Yahoo urged users to change their passwords if they haven't since 2014. The company has 1 billion monthly active users for all its internet services, which span finance, online shopping and fantasy football. Its mail service alone has about 225 million monthly active users, Yahoo told CNET in June. 
 
 The hack serves as a reminder of how widespread hacking is and highlights the vulnerability of passwords. Cybersecurity specialists recommend using a different password for each account you have on the internet. Other experts are working on alternatives to passwords, such as biometrics like your fingerprint or retina. 
 
 "Cybercriminals know that consumers use the same passwords across websites and applications, which is why these millions of leaked password credentials are so useful for perpetuating fraud," said Brett McDowell, executive director of the FIDO Alliance, an organization that vets the security of password alternatives. "We need to take that ability away from criminals, and the only way to do that is to stop relying on passwords altogether." 
 
 Justin Sullivan, Getty Images 
 
 Verizon, which is paying $4.83 billion for Yahoo, said it was notified of the massive breach within the last two days. The telecommunications giant had "limited information and understanding of the impact," according to a statement. 
 
 "We will evaluate, as the investigation continues, through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities," Verizon said. 
 
 B. Riley & Co. analyst Sameet Sinha told The Wall Street Journal the breach was unlikely to affect the sale to Verizon. 
 
 Virginia Sen. Mark Warner, a member of the newly formed Senate Cybersecurity Caucus, criticized Yahoo for not discovering the breach when it originally happened in 2014. 
 
 "While we have seen more and more data breaches in the private sector in recent years, many of them affecting millions of consumers, the seriousness of this breach at Yahoo is huge," Warner said. 
 
 The Privacy Rights Clearinghouse, a nonprofit organization that tracks cybersecurity breaches, said the hack was the largest-ever publicly disclosed breach. 
 
 Yahoo has taken steps to protect its users, including invalidating security questions and answers, but the real risk lies in hackers using the passwords on other websites. 
 
 "We typically see a 0.1 percent to 2 percent log-in success rate from credential stuffing attacks, meaning that a cybercriminal using 500 million passwords to attempt to take over accounts on another website would be able to take over tens of thousands of accounts on most websites," said Shuman Ghosemajumder, Google's former click-fraud czar and CTO of Shape Security. 
 
 Facebook co-founder Mark Zuckerberg's Twitter account was hacked using a similar method after the passwords of more than 100 million LinkedIn members were leaked. 
 
 It will take Yahoo at least several months before it starts regaining users' trust, according to research from Alertsec. The encryption provider did a study that found about 97 percent of Americans lose trust in companies like Yahoo after massive data breaches. 
 
 "When a company has allowed their customers' data to fall into the hands of criminals, the resulting lack of trust is difficult to repair," CEO Ebba Blitz said in a statement. 
 
 On August 1, a hacker named "Peace" claimed to have breached 200 million Yahoo usernames and passwords from a hack in 2012, and offered to sell them on the dark web after trying to do the same with MySpace and LinkedIn accounts. 
 
 A person familiar with the situation said Peace's assertion prompted Yahoo to initiate an internal investigation. That investigation found no evidence that substantiated Peace's claim, but the investigating team found indications that a state-sponsored actor had stolen data in 2014. 
 
 Former Yahoo information security officer Jeremiah Grossman, now chief of security strategy at SentinelOne, said that internet companies, especially giants like Yahoo, face challenges protecting enormous computer networks because the networks offer so many points of entry to attackers. 
 
 "It's unsurprising when breaches, even of this magnitude, take place," Grossman said. "Yahoo certainly isn't the first. And they won't be the last." 
 
 
 
 This story was originally published at 6:30 a.m. PT. 
 
 Updates, 10:20 a.m., 12:09, 12:41, 2:08, 2:30, 3:10, 4:15 and 4:42 p.m. PT: Added details of the 2012 hack that affected Yahoo, LinkedIn and MySpace, and added statements from Yahoo and Verizon, and analysis from experts. ||||| Ailing tech giant Yahoo knew about their data breach affecting hundreds of millions of accounts. The breach is among the largest on record. (Jhaan Elker/The Washington Post) 
 
 Yahoo on Thursday reported the largest data breach in history — affecting at least 500 million user accounts — months after first detecting signs of an intrusion that the company blamed on "state-sponsored" hackers. 
 
 The Web giant called on customers to change their passwords and institute other protective measures, but the largest fallout could be for Yahoo itself. The long-faltering company this summer agreed to sell its core business for $4.8 billion to telecommunications giant Verizon in a deal now clouded by news of the massive breach. Verizon said it learned of the incident only "within the last two days." 
 
 The timeline highlighted a dilemma created by hacks: Companies often take months or even years to report suspicions of breaches — if they report them publicly at all — holding the information back from customers, business partners and even potential new owners of a company. 
 
 [What you should do if you have a Yahoo account] 
 
 "The dark cloud this casts will be very long and will likely impact the merger agreement," Jeff Kagan, a Georgia-based telecommunications industry analyst, said in an email. "We'll just have to wait and see what happens next." 
 
 Yahoo learned of the incident in July, the same month it announced its deal with Verizon, a person familiar with the matter said, speaking on condition of anonymity to freely discuss the issue. 
 
 When asked, Yahoo declined to say whether it first learned of the hack before or after that deal was announced. 
 
 Yahoo ultimately revealed the breach after Recode, a news site focusing on Silicon Valley, reported Thursday morning that the ailing tech giant would confirm a data breach affecting hundreds of millions of accounts. 
 
 The total number of affected accounts, by reaching 500 million, gave it the dubious distinction of being the largest breach on record, said Paul Stephens of the Privacy Rights Clearinghouse. 
 
 [How data breaches grew to massive proportions in 11 years] 
 
 
 
 
 
 Stephens said that consumers must also take steps to take care of matters themselves, outside of their Yahoo accounts. "It's really important that individuals think long and hard about passwords as well as security questions and answers they used on Yahoo that they might have used somewhere else," Stephens said. "It's very important to remember that if that information is available to hackers, they are going to try and use it on other sites as well." 
 
 Yahoo reported that the intrusion apparently began in 2014. Company Chief Information Security Officer Bob Lord wrote in a blog post that names, email address, telephone numbers, dates of birth and answers to "security questions" may have been stolen but financial information such as credit card numbers apparently was not because that data was stored in a separate system. 
 
 "Yahoo is working closely with law enforcement on this matter," Lord wrote. 
 
 Sen. Mark R. Warner (D-Va.) chastised Yahoo for not reporting suspicions of a breach sooner and called on the federal government to impose stricter disclosure requirements for companies. Companies now face a messy patchwork of state disclosure laws but no federal standard for reporting about breaches, including when, how and who was affected. 
 
 "While its scale puts it among the largest on record, I am perhaps most troubled by news that this breach occurred in 2014, and yet the public is only learning details of it today," Warner said in a statement. "Action from Congress to create a uniform data breach notification standard so that consumers are notified in a much more timely manner is long overdue." 
 
 Although President Obama proposed a federal law in 2015 that would give companies 30 days to notify the public about a discovered hack, lawmakers have yet to approve a single national standard. 
 
 On Thursday, Sen. Richard Blumenthal (D-Conn.) called on investigators to determine whether Yahoo intentionally withheld information about the incident to "artificially bolster its valuation" by Verizon — a potentially serious act of deception. 
 
 The impact on Verizon's deal with Yahoo was not immediately clear. Major data breaches have become a routine event for corporate America and also for major government agencies and political groups. The Yahoo intrusion stands out for the sheer scale of the customers apparently affected, a legacy of the company's once-commanding position for Internet users who turned to the company for web searches, email accounts, user groups and news reports. 
 
 The Verizon deal was seen as a relatively soft landing for Yahoo, a company overtaken by competitors in nearly every one of its major businesses. 
 
 Verizon, in a company statement, said that it was monitoring news of the breach. "We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact," the company's statement said. "We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities. Until then, we are not in position to further comment." 
 
 The security breach is yet another bruise for the aging tech firm and chief executive Marissa Mayer, who joined Yahoo in 2012 to effect a turnaround and ended up having to sell the firm's core assets instead. 
 
 Microsoft's recent acquisition of LinkedIn, which came one month after the social network revealed it 167 million of its accounts had been breached, show a breach alone is not necessarily enough to derail a deal, said John Levallo, senior vice president at the public relations and strategic communications firm Levick. 
 
 But he said the tech giant will be hard-pressed to rehabilitate its overall reputation in light of this breach. 
 
 "Focus on the consumer and not the deal," Levallo said. "If I were in that boardroom at this moment in time, I would say we understand there's a huge deal on the table right now. But first address and resolve the issue for your consumers and the transaction will take care of itself." 
 
 Yahoo has had a poor security reputation in the past, one of the many things that Mayer has focused on since becoming chief executive. 
 
 Vice's Motherboard blog in August reported that Yahoo was investigating an alleged breach after the news organization found that a cybercriminal known as "Peace" claimed to be offering 200 million Yahoo user credentials for sale online. The data was advertised on the "dark web" — a part of the Internet accessible only through the use of special software such as the anonymous browsing tool Tor and often associated with illicit activities. 
 
 Staff writers Andrea Peterson and Ellen Nakashima contributed to this report. ||||| Yahoo (YHOO) on Thursday afternoon disclosed a security breach involving at least 500 million customers, but questions are being raised about whether the internet company should have moved sooner to protect users. 
 
 News that Yahoo would disclose the hack was reported Thursday by Recode, which cited several anonymous sources close to the situation. Those sources describe the breach as “widespread and serious,” while declining to elaborate because of possible government investigations and potential lawsuits. 
 
 In early August, tech site Motherboard reported that a hacker who goes by the moniker “Peace” was selling information, including user names, birth dates and scrambled passwords, from 200 million Yahoo accounts. 
 
 “Consumers should be not be reading in the news something Yahoo hasn’t told them,” said Susan Grant, director of consumer protection and privacy at the Consumer Federation of America. “They should be hearing this from Yahoo, not only that we had this problem -- but also about what to do.” 
 
 In confirming the attack on Thursday, Yahoo said user account information was stolen from the company’s network in late 2014 by what the company called a “state-sponsored actor.” The data may have included names, email addresses, phone numbers, dates of birth and passwords. 
 
 Yahoo initiated an internal probe following a report in July of a hacker selling 280 million user credentials on the black market, but found no evidence to substantiate the hacker’s claims, according to a source close to the company. A deeper review by the company’s security team found evidence a date theft occurred in 2014, the source said. 
 
 Yahoo declined comment as to why the company had not notified users earlier. 
 
 Like other companies, Yahoo is subject to data-breach notification laws in effect in 48 states that require companies to alert customers within specific periods of time that their information has been compromised. 
 
 “There are sometimes exceptions for notification when there are good reasons for law enforcement purposes for not revealing,” said Grant. But in Yahoo’s case the data loss has already been revealed, she noted. 
 
 A complicating factor, both for companies and customers, is that notification laws can be ambiguous. In Yahoo’s home state of California, for instance, the statute stipulates only that “The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement.” 
 
 Beyond changing their passwords, Grant advised Yahoo users concerned their information might be compromised to go the government site identitytheft.gov and follow the prompts on what it calls a recovery plan. 
 
 The reports come as Yahoo looks to close a deal to be acquired​ by telecommunications giant Verizon (VZ​), which agreed in July to buy its internet business for $4.8 billion. 
 
 “It doesn’t appear Yahoo had hard enough defenses, and with a merger you have to worry about even more sensitive information being vulnerable, Grant said. “When there’s more information that can be potentially there for the taking, it raises concerns about the adequacy of the security.” 
 
 “Within the last two days, we were notified of Yahoo’s security incident. We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact,” said a Verizon spokesperson. “We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities.” 
 
 AOL did not return requests for comment.
– Yahoo is confirming what Recode describes as a "widespread and serious" data breach affecting 500 million users. Yahoo blames "state-sponsored actors" for the personal data that was stolen in 2014 but only recently discovered to have been stolen, the AP reports. Yahoo had previously been expected to confirm an estimated 200 million users were affected. Motherboard spoke in August to a hacker known as "Peace” who claimed to be hawking data from 200 million Yahoo accounts on the dark web, per Business Insider. The hacker said the data—which includes usernames, passwords, security questions and answers, birth dates, phone numbers, and email addresses—was likely stolen in 2012. No such breach was ever made public. However, Yahoo said at the time that it was "aware of the claim" and was investigating. Confirmation of such a breach—which Hacked.com says could be "the largest data breach on record"—could now affect Yahoo's $4.8 billion sale to Verizon. Not only is it a pain for Verizon, but Yahoo shareholders will be concerned about a possible drop in the company's sale price. The sources tell Recode that government investigations and legal action in regards to breach are expected. In its confirmation of the breach, Yahoo suggested users change their passwords, assuming they haven't already done so since 2014.