Yahoo is poised to confirm a massive data breach of its service, according to several sources close to the situation. The company was the victim of hacking that has exposed several hundred million user accounts. 
 
 While sources were unspecific about the extent of the incursion, since there is the likelihood of government investigations and legal action related to the breach, they noted that it is widespread and serious. 
 
 Earlier this summer, Yahoo said it was investigating a data breach in which hackers claimed to have access to 200 million user accounts and one was selling them online. “It’s as bad as that,” said one source. “Worse, really.” 
 
 The announcement, which is expected to come this week, also has possible larger implications for the $4.8 billion sale of Yahoo’s core business — which is at the core of this hack — to Verizon. The scale of the liability could bring untold headaches to the new owners. Shareholders are likely to worry that it could lead to an adjustment in the price of the transaction. 
 
 That deal is now moving to completion, but the companies cannot be integrated until it is approved by a number of regulatory agencies, as well as Yahoo shareholders. Representatives of Verizon and Yahoo started meeting recently to review the Yahoo business, so that the acquisition would run smoothly once complete. 
 
 But there’s nothing smooth about this hack, said sources, which became known in August when an infamous cybercriminal named “Peace” claimed on a website that he was selling credentials of 200 million Yahoo users from 2012 on the dark web for just over $1,800. The data allegedly included user names, easily decrypted passwords and personal information like birth dates and other email addresses. 
 
 At the time, Yahoo said it was “aware of the claim,” but the company declined to say if it was legitimate and said that it was investigating the information. But it did not issue a call for a password reset to users. Now, said sources, Yahoo might have to, although it will be a case of too little, too late. 
 
 The confirmation of such an extensive hack is another blemish on the record of CEO Marissa Mayer, a vaunted former Google exec who has presided over numerous declines in the business since she arrived four years ago. Her inability to turn Yahoo around or innovate any new products eventually led to the sale. 
 
 I reached out to Yahoo for comment and will update this post if I get a response (don’t wait up late for that!). ||||| Yahoo! is expected to confirm its unwelcome distinction of being the victim of the largest data breach on record. A report has the tech giant is expected to disclose details of a hack that has affected some 200 million Yahoo users. 
 
 Yahoo! Inc., is preparing to confirm a “massive data breach” of its core service, one that could affect and expose ‘several’ hundred million user accounts. 
 
 Tech news site Recode broke the news, citing sources who noted the breach to be “widespread and serious”, with the likelihood of legal action and investigations led by the government. 
 
 The revelation would come at a time when Yahoo is the midst of a mega-acquisition by Verizon in a $4.8 billion deal and it remains to be seen if the deal could see repercussions due to the breach. 
 
 Earlier in August, Motherboard reported that a cybercriminal hacker who goes by the moniker “Peace” was advertising the sale of 200 million Yahoo accounts. The same hacker has previously sold large data dumps of breaches related to Myspace and LinkedIn on a dark web marketplace called the Real Deal. 
 
 While the lagging technology giant admitted that it was investigating the data breach, a Recode source confirmed that the number of users affected could be more than the 200 million advertised by Peace. 
 
 “It’s as bad as that,” said the Recode source. “Worse, really.” 
 
 The data trove reportedly contains Yahoo users’ usernames, scrambled passwords, birthdates and other information, likely dated from 2012. 
 
 Peace was hawking the alleged data of 200 million users for a relatively mere 3 bitcoins, around $1900 in value at the time. 
 
 Featured image from iStock/4×6. ||||| Yahoo CEO Marissa Mayer. Getty/Kimberly White Yahoo is getting ready to confirm a huge, historic hack affecting 200 million users, Recode reports. 
 
 Back in August, Motherboard's Joseph Cox reported that 200 million apparent Yahoo user credentials were being sold on the dark web. At the time, the company's response was only that it was "aware of [the] claim." 
 
 But now Kara Swisher, one of the tech industry's most respected journalists, is reporting for Recode that Yahoo sources tell her the company is preparing to publicly confirm the hack. (Her sources did not confirm its exact size, only that it was "widespread and serious.") 
 
 Yahoo did not immediately respond to Business Insider's request for comment. 
 
 Motherboard was told by the hacker who held the data (and was selling it for 3 bitcoins, worth $1,860 at the time) that the breach was carried out in 2012 — and was never made public. Data included usernames, encrypted passwords, date-of-births, and some email addresses. 
 
 A spate of historic data breaches affecting millions of users have recently been coming to light, affecting companies including LinkedIn, MySpace, and Tumblr. If user passwords are unencrypted (or not encrypted properly), hackers can then use this login data to break into individual user accounts — and often, because people reuse passwords across multiple sites, the hackers can use the information to break into accounts on other sites as well. 
 
 We saw multiple high-profile demonstrations of this problem this summer, as celebrities and public figures including Mark Zuckerberg and Drake had their Twitter accounts broken into. Twitter wasn't hacked — but the victims had reused passwords that were also used on hacked websites. 
 
 This new attention on the alleged breach comes at an awkward time for Yahoo. The tech company is selling its core business to Verizon for $4.8 billion (£3.7 billion) after years of flagging fortunes. 
 
 There's nothing ordinary users can do to prevent these kinds of breaches, but using a strong, unique password on each website or service you have an account on (managing those passwords with a password-manager app if necessary) will help limit the damage. ||||| A notorious cybercriminal is advertising 200 million of alleged Yahoo user credentials on the dark web, and the company has said it is “aware” of the hacker’s claims, but has not confirmed nor denied the legitimacy of the data. 
 
 On Monday, the hacker known as Peace, who has previously sold dumps of Myspace and LinkedIn, listed supposed credentials of Yahoo users on The Real Deal marketplace. Peace told Motherboard that he has been trading the data privately for some time, but only now decided to sell it openly. 
 
 “We are aware of a claim,” a Yahoo spokesperson told Motherboard in an email, before the data was made public. The company did not deny that the customer details were Yahoo users, despite being asked if it corresponded to the company's own records. 
 
 “We are committed to protecting the security of our users’ information and we take any such claim very seriously. Our security team is working to determine the facts. Yahoo works hard to keep our users safe, and we always encourage our users to create strong passwords, or give up passwords altogether by using Yahoo Account Key, and use different passwords for different platforms.” 
 
 A screenshot of the listing for the sale of the alleged hacked Yahoo data. 
 
 According to a sample of the data, it contains usernames, hashed passwords (created with md5 algorithm), dates of birth, and in some cases back-up email addresses. The data is being sold for 3 bitcoins, or around $1,860, and supposedly contains 200 million records from “2012 most likely,” according to Peace. Until Yahoo confirms a breach, however, or the full dataset is released for verification, it is possible that the data is collated and repackaged from other major data leaks. 
 
 Peace told Motherboard, “well fuck them they dont want to confirm well better for me they dont do password reset.” Many companies issue password resets to accounts affected by data breaches, or even preemptively in a case like this in which the provenance of leaked data is not entirely clear. 
 
 Motherboard obtained a very small sample of the data—only 5000 records—before it was publicly listed, and found that most of the two dozen Yahoo usernames tested by Motherboard did correspond to actual accounts on the service. (This was done by going to the login section of Yahoo, entering the email address, and clicking next; when the email address wasn’t recognised, it was not possible to continue.) 
 
 However, when Motherboard attempted to contact over 100 of the addresses in the sample set, many returned as undeliverable. “This account has been disabled or discontinued,” read one autoresponse to many of the emails that failed to deliver properly, while others read “This user doesn’t have a yahoo.com account.” ||||| FILE - In this June 5, 2014, file photo, people walk in front of a Yahoo sign at the company's headquarters in Sunnyvale, Calif. Yahoo says the personal information of 500 million accounts have been stolen... (Associated Press) 
 
 FILE - In this June 5, 2014, file photo, people walk in front of a Yahoo sign at the company's headquarters in Sunnyvale, Calif. Yahoo says the personal information of 500 million accounts have been stolen... (Associated Press) 
 
 SAN FRANCISCO (AP) — Yahoo said hackers stole personal information from 500 million of its user accounts, a massive security breakdown it attributed to a "state sponsored actor." The breach disclosed Thursday, the latest setback for the beleaguered internet company, dates back to late 2014. 
 
 That's when high-tech thieves hacked into Yahoo's data centers, the company said. But Yahoo only recently discovered the break-in as part of an ongoing internal investigation. 
 
 The stolen data includes users' names, email addresses, telephone numbers, birth dates, hashed passwords, and the security questions — and answers — used to verify an accountholder's identity. 
 
 Last month, the tech site Motherboard reported that a hacker who uses the name "Peace" boasted that he had account information belonging to 200 million Yahoo users and was trying to sell the data on the web. 
 
 Yahoo recommends that users change their passwords if they haven't done so since 2014. The Sunnyvale, California, company said its investigation so far hasn't found any evidence that information about users' bank accounts or credit and debit cards were swiped in the hacking attack. It said it has "no evidence" that the attacker is still in Yahoo's network. 
 
 News of the security lapse could cause some people to have second thoughts about relying on Yahoo's services, raising a prickly issue for the company as it tries to sell its digital operations to Verizon Communications for $4.8 billion. 
 
 That deal, announced two months ago, isn't supposed to close until early next year. That leaves Verizon with wiggle room to renegotiate the purchase price or even back out if it believes the security breach will harm Yahoo's business. That could happen if users shun Yahoo or file lawsuits because they're incensed by the theft of their personal information. 
 
 Verizon said it still doesn't know enough about the Yahoo break-in to assess the potential consequences. "We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities," the company said in a statement.
– Yahoo is confirming what Recode describes as a "widespread and serious" data breach affecting 500 million users. Yahoo blames "state-sponsored actors" for the personal data that was stolen in 2014 but only recently discovered to have been stolen, the AP reports. Yahoo had previously been expected to confirm an estimated 200 million users were affected. Motherboard spoke in August to a hacker known as "Peace” who claimed to be hawking data from 200 million Yahoo accounts on the dark web, per Business Insider. The hacker said the data—which includes usernames, passwords, security questions and answers, birth dates, phone numbers, and email addresses—was likely stolen in 2012. No such breach was ever made public. However, Yahoo said at the time that it was "aware of the claim" and was investigating. Confirmation of such a breach—which Hacked.com says could be "the largest data breach on record"—could now affect Yahoo's $4.8 billion sale to Verizon. Not only is it a pain for Verizon, but Yahoo shareholders will be concerned about a possible drop in the company's sale price. The sources tell Recode that government investigations and legal action in regards to breach are expected. In its confirmation of the breach, Yahoo suggested users change their passwords, assuming they haven't already done so since 2014.