The usernames and passwords of some of Yahoo’s email customers have been stolen and used to gather personal information about people those Yahoo mail users have recently corresponded with, the company said Thursday. The hack appears to have taken place via a compromised third-party database. Yahoo said it is resetting passwords on affected accounts and you should be getting an email or text message (if you’ve set up two-factor authentication) with further details.
“Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts,” Yahoo senior VP Jay Rossiter said in a Tumblr post. Yahoo has “implemented additional measures” to block further attacks and the company is said to work with federal law enforcement. Yahoo didn’t say how many accounts have been affected.
Because so many people use the same passwords across multiple sites, it’s possible hackers broke into some service that lets people use email addresses as their usernames. The hackers could have grabbed passwords stored at that service, filtered out the accounts with Yahoo addresses, and used that information to log in to Yahoo’s mail systems, said Johannes Ullrich, dean of research at the SANS Institute, a group devoted to security research and education.
Yahoo is the second-largest email service worldwide, after Google’s Gmail, according to the research firm ComScore. There are 273 million Yahoo mail accounts worldwide, including 81 million in the U.S.
