Yahoo CEO Marissa Mayer. Reuters/Pascal Lauener More than 1 billion Yahoo user accounts — including phone numbers, birthdates, and security questions — may have been stolen by hackers during an attack that took place in August 2013, the company revealed on Wednesday.

The announcement of what could represent the largest hack of all time is a separate incident than the one Yahoo disclosed back in September. In that hack, Yahoo said that at least 500 million user accounts were compromised.

"The company has not been able to identify the intrusion associated with this theft," Yahoo said on Wednesday about the new incident.

News of the breach sent Yahoo shares sliding about 2.5% in after-hours trading on Wednesday.

The revelation of the hack could have implications for the $4.8 billion sale of Yahoo to Verizon, which has yet to close. Yahoo disclosed the previous hack to Verizon only after agreeing to the deal, and Verizon has since said that it considers the hack a material event that could affect the terms and price of the acquisition.

"As we've said all along, we will evaluate the situation as Yahoo continues its investigation," Verizon told CNBC on Wednesday, regarding the latest hack.

Forged cookies

With a billion accounts at risk, that would make this the biggest breach of ever — bigger than the Myspace breach of 360 million user accounts and 427 million passwords.

Yahoo said that payment-card data and bank-account information were not stored on the system the company "believes" was affected. But the hackers may have collected a trove of other valuable personal information, such as user names, email addresses, telephone numbers, dates of birth, hashed passwords, and, in some cases, encrypted or unencrypted security questions and answers.

Yahoo said that it now believes an "unauthorized third party accessed the company's proprietary code to learn how to forge cookies." It was not clear which incident the forged cookies related to. But Yahoo said that "the company has connected some of this activity to the same state-sponsored actor believed to be responsible for the data theft the company disclosed on September 22, 2016."

Here's the entire message from Yahoo:</s>SAN FRANCISCO — Yahoo, already reeling from its September disclosure that 500 million user accounts had been hacked in 2014, disclosed Wednesday that a different attack in 2013 compromised more than 1 billion accounts.

The two attacks are the largest known security breaches of one company’s computer network.

The newly disclosed 2013 attack involved sensitive user information, including names, telephone numbers, dates of birth, encrypted passwords and unencrypted security questions that could be used to reset a password. Yahoo said it is forcing all of the affected users to change their passwords and it is invalidating unencrypted security questions — steps that it declined to take in September.

It is unclear how many Yahoo users were affected by both attacks. The internet company has more than 1 billion active users, but it is not clear how many inactive accounts were hacked.</s>The latest Yahoo hack exposed personal details from more than 1 billion user accounts, the largest known data breach in history.

Despite the size of the break-in, which apparently dates back to August 2013, attackers don't appear to have accessed obviously sensitive information such as financial data or Social Security numbers.

Here's how the Yahoo attack revealed today stacks up against other recent major hacks.

Yahoo disclosed in September that hackers swiped personal information from at least 500 million Yahoo accounts. At the time, that hack was believed to be the biggest digital break-in at an email provider.

That breach dated back to late 2014. Yahoo said it believes the 2014 hack was distinct from the 2013 breach it announced today.

The company later revealed in a regulatory filing that it had detected evidence that a hacker had broken into its computer network at least 18 months before it launched the investigation that discovered the breach.</s>Internet giant Yahoo has said it believes hackers stole personal data from more than one billion user accounts as part of a cyber attack that occurred in 2013.

The technology giant said it believes the attack is "distinct" from another cyber attack the company reported in September this year, which involved around 500 million accounts and was said to have been carried out by a "state-sponsored actor" in late 2014.

Yahoo says this personal data affected included "names, email addresses, telephone numbers, dates of birth, hashed passwords", as well as security questions and answers, but the company claimed financial information had not been compromised.

"Yahoo has identified data security issues concerning certain Yahoo user accounts," the firm said in a statement.

"Yahoo has taken steps to secure user accounts and is working closely with law enforcement.

"As Yahoo previously disclosed in November, law enforcement provided the company with data files that a third party claimed was Yahoo user data. The company analysed this data with the assistance of outside forensic experts and found that it appears to be Yahoo user data.

"Based on further analysis of this data by the forensic experts, Yahoo believes an unauthorised third party, in August 2013, stole data associated with more than one billion user accounts."

The company also said it analysis has led it to believe the same state-sponsored hackers were involved in this newly-disclosed attack.

"Yahoo encourages users to review all of their online accounts for suspicious activity and to change their passwords and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account," the statement said.

"The company further recommends that users avoid clicking links or downloading attachments from suspicious emails and that they be cautious of unsolicited communications that ask for personal information."

The firm, which is currently being taken over by Verizon, said it was continuing to work with law enforcement authorities.</s>NEW YORK CITY (dpa-AFX) - ahoo! Inc. (YHOO) disclosed another major security breach that may have affected more than 1 billion user accounts, another blow to the company's reputation as it nears the sale of its main web businesses to Verizon Communications Inc.(VZ)



YHOO closed Wednesday's regular trading at $40.91, down $0.56 or 1.35 percent. In the after-hours, the stock further dropped $0.92 or 2.25 percent.



Yahoo said Wednesday that it hasn't been able to identify the 'intrusion' associated with this theft by a third party in August 2013. The event was unearthed by forensic experts after law enforcement investigators warned the company about a potential breach.



Yahoo believes this incident is likely distinct from the incident the company disclosed on September 22, 2016.



In September, Yahoo said the personal information of at least 500 million accounts was stolen in a 2014 attack on its accounts. The attacker was a 'state-sponsored actor,' and stolen information may have included names, e-mail addresses, phone numbers, dates of birth, encrypted passwords and, in some cases, unencrypted security questions and answers, Yahoo said.



In November, Yahoo gave an update to investors on its internal review of the hack, saying an independent board committee is investigating how many employees at Yahoo knew about the breach.



Yahoo said last month the $4.8 billion sale of its web portal still is expected to close in the first quarter of next year. 



'As we've said all along, we will evaluate the situation as Yahoo continues its investigation,' Verizon said. 'We will review the impact of this new development before reaching any final conclusions.'



If the investigation shows significant harm to the business and Yahoo customers, Verizon would consider options like reducing the deal price or walking away, reports said Wednesday citing people familiar with the matter. The acquisition still makes strategic sense for Verizon.



In the 2013 hack disclosed Wednesday, Yahoo said the stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers. The investigation indicated that the stolen information did not include passwords in clear text, payment card data, or bank account information. Payment card data and bank account information are not stored in the system the company believes was affected. 



Yahoo is notifying potentially affected users and has taken steps to secure their accounts, including requiring users to change their passwords. Yahoo has also invalidated unencrypted security questions and answers so that they cannot be used to access an account. 



Yahoo previously disclosed that its outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password. Based on the ongoing investigation, the company believes an unauthorized third party accessed the company's proprietary code to learn how to forge cookies. The outside forensic experts have identified user accounts for which they believe forged cookieswere taken or used. Yahoo is notifying the affected account holders, and has invalidated the forged cookies. The company has connected some of this activity to the same state-sponsored actor believed to be responsible for the data theft the company disclosed on September 22, 2016. 



Yahoo recommended using 'Yahoo Account Key', a simple authentication tool that eliminates the need to use a password on Yahoo altogether.



Copyright RTT News/dpa-AFX</s>Just when you think Yahoo's security issues can't get any worse, the company proves you wrong.

Yahoo (YHOO, Tech30) disclosed a new security breach on Wednesday that may have affected more than one billion accounts. The breach dates back to 2013 and is thought to be separate from a massive cybersecurity incident announced in September.

Yahoo now believes an "unauthorized third party" stole user data from more than one billion accounts in August 2013. That data may have included names, email addresses and passwords, but not financial information.

The company will notify users who may be affected and has begun requiring users to change their passwords.

The security incident, likely one of the largest cybersecurity breaches ever, comes less than three months after Yahoo admitted data from at least 500 million accounts had been stolen.

Related: Got a hacked Yahoo account? Here's what you should do

That earlier breach, which Yahoo has attributed to a "state-sponsored actor," is likely unrelated to the newly disclosed breach, according to the company.

"We believe this incident is likely distinct from the incident we disclosed on September 22, 2016," Bob Lord, Yahoo's chief information security officer, wrote in a blog post.

The second cybersecurity breach raises more concerns about whether Yahoo took enough precautions. As one former employee told CNNMoney after the first breach was disclosed, "Security was pushed to the back end" behind "other priorities."

The original breach was initially viewed as a threat to Verizon's (VZ, Tech30) $4.8 billion deal to buy Yahoo, given the potential impact on Yahoo's brand and user retention. Verizon learned about the breach after agreeing to the acquisition and later said it could have a meaningful financial impact on the deal.

AOL CEO Tim Armstrong said earlier this month he was "cautiously optimistic" the deal would go through -- but the second massive breach could change that.

"As we've said all along, we will continue to evaluate the situation as Yahoo continues its investigation," Verizon said in a statement Wednesday. "We will review the impact of this new development before reaching any final conclusions."

Yahoo's stock fell 2.5% in after hours trading Wednesday following the disclosure.</s>Yahoo Inc said on Wednesday that it has identified a new system breach that occurred in August 2013 and involved data associated with more than one billion user accounts.

The company said it believed this incident is likely distinct from the breach it disclosed in September, when information associated with at least 500 million user accounts was stolen from its network in 2014.

Yahoo, which is being acquired by Verizon, said an unauthorized third party had stolen the data in the latest breach and that it was working closely with law enforcement.

Yahoo said the stolen user account information may have included names, e-mail addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers.

Payment card data and bank account information were not stored in the system believed to be affected, the company said.</s>Yahoo Inc. revealed new security issues affecting more than a billion users’ data, a theft that is separate and twice as large as the hack it disclosed earlier this year.

On Wednesday, Yahoo said an unauthorized third party stole data associated with more than 1 billion user accounts in August 2013. In September, Yahoo blamed “state-sponsored” hackers for stealing data on 500 million user accounts, which at the time was the largest theft of personal user data ever disclosed.

Yahoo, which has agreed to sell its core business to Verizon Communications, said it has connected some of the activity disclosed Wednesday to the same state-sponsored actor believed to be responsible for the data theft disclosed in September.

On Wednesday, Verizon said it would review the impact of the new breach.

Yahoo said it has taken steps to secure user accounts and is working closely with law enforcement.

In November, Yahoo disclosed law enforcement gave the company data files that a third party claimed was Yahoo user data. On Wednesday, the company confirmed it appears to be Yahoo user data.

Yahoo said it hasn’t identified the intrusion associated with the theft but believes it is likely distinct from the incident the company disclosed in September.

The stolen data in both cases may have included names, email addresses, dates of birth, telephone numbers and encrypted passwords, Yahoo said.

The company urged users to review all of their online accounts and to change their passwords and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account. It also recommended users avoid clicking links or downloading attachments from suspicious emails and remain cautious of unsolicited communication asking for personal information.

Separately, Yahoo, which had previously disclosed that its outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password, said Wednesday it believes an unauthorized third party accessed the company’s proprietary code to learn how to forge cookies. Yahoo is notifying affected account holders, and has invalidated the forged cookies.</s>Yahoo said Wednesday that 1 billion user accounts — meaning most of the Internet giant’s customers worldwide — were hacked by a “state-sponsored” attacker in 2013, leading to the release of user names, telephone numbers, dates of birth and other personal information.

Report of the hack, coming after the announcement of a separate hack affecting 500 million accounts in September, means that Yahoo has been the victim of two of the biggest data breaches in history, both of which have been announced since Yahoo agreed to sell its core businesses to telecommunications giant Verizon in July for $4.8 billion. The incident raised new questions among analysts regarding the viability of that deal and whether the valuation will need to be changed, especially if the series of hacks triggers litigation against the company.

“The fact that we now have two breaches implies that Yahoo security measures were inadequate. So it is more likely there will be future breaches uncovered,” said analyst Laura Martin, senior analyst entertainment and Internet at Needham Equity Research.

In the 2013 incident, Yahoo said that credit card and bank account numbers, which are stored separately, were not affected. The company is requiring customers who were affected to change their passwords.

Yahoo also reported a separate incident Wednesday in which hackers used what the company called “forged cookies” to gain access to some accounts, though it did not give the number. That incident, the company said, appeared to have links to the one announced in September.

“Yahoo encourages users to review all of their online accounts for suspicious activity and to change their passwords and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account,” the company said in a statement. “The company further recommends that users avoid clicking links or downloading attachments from suspicious emails and that they be cautious of unsolicited communications that ask for personal information.”

Verizon spokesman Bob Varettoni said, “As we’ve said all along, we will evaluate the situation as Yahoo continues its investigation. We will review the impact of this new development before reaching any final conclusions.”

Regarding the deal, Yahoo said in a statement, “We are confident in Yahoo’s value and we continue to work towards integration with Verizon.”</s>Yahoo said it discovered the breach while reviewing data provided to the company by law enforcement. (Photo: AP)

Yahoo warned on Wednesday that it had uncovered yet another massive cyber attack, saying data from more than 1 billion user accounts was compromised in August 2013, making it the largest breach in history.

The number of affected accounts was double the number implicated in a 2014 breach that the internet company disclosed in September and blamed on hackers working on behalf of a government. News of that attack, which affected at least 500 million accounts, prompted Verizon Communication Inc to say in October that it might withdraw from an agreement to buy Yahoo's core internet business for $4.83 billion.

Following the latest disclosure, Verizon said, "We will review the impact of this new development before reaching any final conclusions."

A Yahoo spokesman told Reuters that the company has been in communication with Verizon during its investigation into the breach and that it is confident the incident will not affect the pending acquisition.

Yahoo required all of its customers to reset their passwords - a stronger measure than it took after the previous breach was discovered, when it only recommended a password reset.

Yahoo also said Wednesday that it believes hackers responsible for the previous breach had also accessed the company’s proprietary code to learn how to forge "cookies" that would allow hackers to access an account without a password.

"Yahoo badly screwed up," said Bruce Schneier, a cryptologist and one of the world's most respected security experts. "They weren't taking security seriously and that's now very clear. I would have trouble trusting Yahoo going forward."

Yahoo was tentative in its description of new problems, saying the incident was "likely" distinct from the one it reported in September and that stolen information "may have included" names, e-mail addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers.

It said it had not yet identified the intrusion that led to the massive data theft and noted that payment-card data and bank account information were not stored in the system the company believes was affected.

Yahoo said it discovered the breach while reviewing data provided to the company by law enforcement. FireEye Mandiant unit and Aon Plc's Stroz Friedberg are assisting in the investigation, the Yahoo spokesman told Reuters.

The breach is the latest setback for Yahoo, an internet pioneer that has fallen on hard times in recent years after being eclipsed by younger, fast-growing rivals including Alphabet Inc's Google and Facebook.

Hours before it announced the breach on Wednesday, executives with Google, Facebook and other large US technology companies met with President-elect Donald Trump in New York. Reflecting its diminished stature, Yahoo was not invited to the summit, according to people familiar with the meeting.

The Yahoo spokesman said Chief Executive Marissa Mayer was at the company's Sunnyvale, California headquarters to assist in addressing the new breach.

Yahoo shares were down 2.4 per cent to $39.91 in extended trading. Verizon shares were little changed from their close at $51.63.
Yahoo! announces that ID information about more than 1 billion accounts may have been hacked in August 2013. This is separate from the company's earlier disclosure of a data breach of 500,000 accounts in 2014.