The 2013–2014 Yahoo! data breaches refer to two distinct, massive cyberattacks against the multinational technology company Yahoo! Inc. Disclosed to the public in late 2016, these breaches represent the largest known security compromises of a single corporate network in the history of the internet.
The first breach, occurring in August 2013, ultimately compromised every single user account existing on Yahoo's servers at the time—a total of 3 billion accounts. A separate attack in late 2014, executed by state-sponsored actors affiliated with Russian intelligence services, compromised an additional 500 million accounts. The belated discovery and disclosure of these hacks severely damaged public trust, triggered massive class-action lawsuits, and forced a historic $350 million reduction in the purchase price of Yahoo's core internet business by Verizon Communications.
The 2013 breach (3 Billion Accounts)
In August 2013, unauthorized third parties gained access to Yahoo's internal network. When Yahoo first reported the 2013 breach in December 2016, they estimated that 1 billion accounts had been compromised. However, further forensic analysis revealed the grim truth: the breach had actually affected all 3 billion user accounts that existed on the service at the time.
The 2014 state-sponsored breach
In late 2014, a targeted espionage operation compromised 500 million accounts. Unlike the 2013 breach, this attack utilized a spear-phishing campaign and "forged cookies" created from stolen cryptographic keys, allowing attackers to log directly into targeted accounts without passwords.
Perpetrators of the 2014 breach
In March 2017, the U.S. Department of Justice unsealed indictments against four individuals connected to the 2014 breach.
Dmitry Dokuchaev and Igor Sushchin
Officers from Russia's Federal Security Service (FSB) who directed and facilitated the operation.
Alexsey Belan
A notorious, wanted cybercriminal hired by the FSB to execute the technical break-in.
Karim Baratov
A hacker-for-hire based in Canada who was hired to break into specific accounts linked to Yahoo users; he was arrested and sentenced to five years in prison.
Discovery, disclosure, and the Verizon acquisition
Yahoo finally admitted to the breaches in late 2016. The revelation caused the sale of Yahoo's core internet business to Verizon to be renegotiated, resulting in a $350 million discount.
Impact and legacy
The breaches resulted in the first-ever SEC penalty for failing to disclose a breach to investors ($35 million) and a $117.5 million class-action settlement.