Yahoo 2013 Account Security Update FAQs

Yahoo is providing notice to additional user accounts affected by an August 2013 theft of user data previously announced by the company in December 2016. This is not a new security issue. In 2016, Yahoo previously took action to protect all user accounts.

Below are updated FAQs containing details about the issue Yahoo announced in December 2016, what was done to secure user accounts, and additional account security recommendations.

What happened?

On December 14, 2016, Yahoo announced that, based on its analysis of data files provided by law enforcement, the company believed that an unauthorized party stole data associated with certain user accounts in August 2013. In addition to posting a public notice on its website and issuing a press release, Yahoo notified the users it had identified at that time as potentially affected. We recently obtained additional information and, after analyzing it with the assistance of outside forensic experts, we have identified additional user accounts that were affected. We are now notifying the additional user accounts.

Was my account affected by the August 2013 incident?

Based on an analysis of the information with the assistance of outside forensic experts, Yahoo has determined that all accounts that existed at the time of the August 2013 theft were likely affected.

It is important to note that, in connection with Yahoo’s December 2016 announcement of the August 2013 theft, Yahoo took action to protect all accounts. The company required all users who had not changed their passwords since the time of the theft to do so. Yahoo also invalidated unencrypted security questions and answers so they cannot be used to access an account.

What information was taken in the August 2013 incident?

For affected accounts, the stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers. The investigation indicates that the information that was stolen did not include passwords in clear text, payment card data, or bank account information. Payment card data and bank account information are not stored in the system the company believes was affected.

Is this October 2017 notification related to the data theft that Yahoo announced on December 14, 2016?

Yes; this is not a new issue. This October 2017 notification relates to the same data theft that Yahoo announced on December 14, 2016.

Are any of the additional accounts you are notifying now believed to be affected by cookie forging?

Yahoo previously notified the user accounts it believes were affected by the cookie forging activity. No additional notifications regarding the cookie forging activity are being sent in connection with this update. Some of the additional user accounts we are notifying now about the August 2013 data theft may have been notified previously about the cookie forging activity if Yahoo believed that a forged cookie associated with their account was used or taken.

What is a “hashed” password?

Hashing is a one-way mathematical function that converts an original string of data into a seemingly random string of characters. As such, passwords that have been hashed can’t be reversed into the original plain text password. At the time of the August 2013 incident, Yahoo used MD5 to hash passwords. Yahoo began upgrading password protection to bcrypt in the summer of 2013. Bcrypt is a password hashing mechanism that incorporates security features, including salting and multiple rounds of computation, to provide advanced protection against password cracking.

I think I received an email about this issue. How do I know that this is really from Yahoo?

Click here to view the content of our notice to potentially affected users. Please note that the email from Yahoo about this issue will display the Yahoo icon Purple Y icon when viewed through the Yahoo website or Yahoo Mail app. Importantly, the email does not ask you to click on any links or contain attachments and does not request your personal information. If an email you received about this issue prompts you to click on a link, download an attachment, or asks you for information, the email was not sent by Yahoo and may be an attempt to steal your personal information. Avoid clicking on links or downloading attachments from such suspicious emails.

What is Yahoo doing to protect my account?

In connection with the December 2016 announcement, Yahoo took action to protect users beyond those identified at that time as potentially affected. Specifically:

  • Yahoo required potentially affected users to change their passwords.
  • Yahoo also required all other users who had not changed their passwords since the time of the theft to do so.
  • Yahoo invalidated unencrypted security questions and answers so they cannot be used to access an account.

We are continuing to work closely with law enforcement, and continue to enhance our safeguards and systems that detect and prevent unauthorized access to user accounts.

How do I change my password or disable security questions and answers?

You can change your Yahoo password or disable your security questions and answers by clicking here. In connection with the December 2016 announcement, we required users who had not changed their passwords since the time of the theft to do so. We also invalidated unencrypted security questions and answers so they cannot be used to access an account.

Is there anything I can do to protect myself?

While Yahoo already has taken action to help secure user accounts, we encourage our users to consider the following account security recommendations:

  • Change your passwords and security questions and answers for any other accounts on which you used the same or similar information used for your Yahoo Account.
  • Review your accounts for suspicious activity.
  • Be cautious of any unsolicited communications that ask for your personal information or refer you to a web page asking for personal information.
  • Avoid clicking on links or downloading attachments from suspicious emails.

Additionally, please consider using Yahoo Account Key, a simple authentication tool that eliminates the need to use a password on Yahoo altogether.

What additional steps can I take to protect my information?

Although the user account information that was stolen did not include passwords in clear text, payment card data, or bank account information, we encourage you to remain vigilant by reviewing your account statements and monitoring your credit reports. Click here for information on how to obtain your credit report.

To help protect yourself from possible identity theft, consider placing a fraud alert on your credit file. You also may wish to place a “security freeze” (also known as a “credit freeze”) on your credit file. A security freeze is designed to prevent potential creditors from accessing your credit file at the consumer reporting agencies without your consent. There may be fees for placing, lifting, and/or removing a security freeze, which generally range from $5-$20 per action. Unlike a fraud alert, you must place a security freeze on your credit file at each consumer reporting agency individually. For more information on security freezes, you may contact the three nationwide consumer reporting agencies or the FTC. As the instructions for establishing a security freeze differ from state to state, please contact the three consumer reporting agencies to find out more information.

You have the right to obtain a police report and request a security freeze as described above. The consumer reporting agencies may require that you provide certain personal information (such as your name, Social Security number, date of birth, and address) and proper identification (such as a copy of a government-issued ID card and a bill or statement) prior to honoring your request for a security freeze. There is no charge, however, to place, lift or remove a security freeze if you have been a victim of identity theft and you provide the consumer reporting agencies with a valid police report.

For U.S. residents, you can contact the FTC to learn more about protecting your personal information. The contact information for the FTC is below:

Federal Trade Commission
Consumer Response Center
600 Pennsylvania Avenue, NW
Washington, DC 20580
1-877-IDTHEFT (438-4338)
www.ftc.gov/idtheft/

How can I get help with my account?

If you need further information or assistance with your account, please visit help.yahoo.com, where you will find the latest information and may be able to access direct customer support. DO NOT ENGAGE with any support service other than those provided by Yahoo, particularly support service providers that charge a fee for their service. Yahoo does not charge for support service for its accounts. Please note that Yahoo channels all support through help.yahoo.com.