2013 Yahoo breach

2013 Yahoo breach
Title	2013 Yahoo breach
Date	2013 (disclosed 2016, 2017, 2019)
Location	Sunnyvale, California
Type	Data breach, account compromise
Affected	Yahoo user accounts (reported 3 billion, 1 billion, 500 million)
Perpetrators	Alleged state-sponsored actors, indicted individuals

2013 Yahoo breach

In 2013, a major security compromise affected user accounts at Yahoo!, one of the world's largest Internet companies, prompting disclosures involving Verizon Communications, Altaba, and multiple law enforcement agencies. The incident intersected with high-profile figures and institutions including Marissa Mayer, the United States Department of Justice, Federal Bureau of Investigation, and technology partners like Google LLC and Microsoft. Coverage spanned outlets and organizations such as The New York Times, The Washington Post, Reuters (news agency), and Bloomberg L.P..

Background

Yahoo!'s services, including Yahoo Mail, Flickr, and Yahoo Finance, were central to millions of accounts linked to companies such as AOL, Verizon Communications, and investments held by Sequoia Capital. Leadership under Marissa Mayer pursued acquisitions like Tumblr (company) and restructurings involving Oath Inc. and later Altaba assets. Prior incidents involving entities such as LinkedIn, MySpace, and Dropbox (service) had increased scrutiny from regulators including the United States Securities and Exchange Commission and privacy advocates like Electronic Frontier Foundation.

Breach Discovery and Disclosure

Initial reporting on the 2013 compromise emerged amid separate disclosures of intrusions affecting Yahoo! in 2014 and 2015, with public statements tied to negotiations with Verizon Communications for acquisition. Yahoo! publicly announced a large-scale breach in 2016, then revised the scope in 2017 and 2019 as forensic teams from firms like KPMG and Stroz Friedberg coordinated with investigators from the Federal Bureau of Investigation and the United States Department of Justice. Coverage by outlets including The Wall Street Journal, Financial Times, and The Guardian (London) connected the timelines to corporate decisions and pending deals involving Verizon Communications and legal counsel from firms like Skadden, Arps, Slate, Meagher & Flom.

Scope and Impact

The breach exposed credentials, security questions, and personal data for hundreds of millions to billions of accounts, with reported figures affecting users worldwide including markets dominated by companies such as Alibaba Group and SoftBank Group. Impacts were assessed by cybersecurity firms including Symantec, FireEye, and Kaspersky Lab, and analyzed by academics at institutions like Massachusetts Institute of Technology, Stanford University, and Carnegie Mellon University. The breach had commercial repercussions for Verizon Communications's acquisition valuation, affecting negotiations with investors such as Silver Lake Partners and triggering scrutiny from the United States Securities and Exchange Commission.

Investigation and Attribution

Investigations led to indictments and allegations involving individuals and groups linked to state actors; reporting and legal filings referenced officials from the United States Department of Justice and indictments unsealed in multiple jurisdictions. Cybersecurity attribution studies by firms like FireEye and law enforcement statements linked the operation to actors associated with nation-state capabilities, prompting diplomatic sensitivities involving countries cited in media such as Russia and China. Legal proceedings involved prosecutors from the United States Attorney's Office and cooperation with international agencies including Europol and national law enforcement in countries like Estonia and Ukraine.

Legal and Regulatory Consequences

The incident spawned class-action lawsuits filed in federal courts, with plaintiffs represented by firms that had litigated against technology companies such as Facebook, Equifax (company), and Uber. Regulators including the United States Securities and Exchange Commission and state attorneys general investigated disclosure practices, while consumer protection agencies such as the Federal Trade Commission monitored remediation. Settlements and fines were negotiated amid corporate transitions involving Verizon Communications's integration and the formation of Altaba. Proceedings referenced precedent cases like actions against Target Corporation and Home Depot.

Response and Remediation

Yahoo! implemented forced password resets, invalidated unencrypted security questions, and urged users to adopt stronger authentication such as two-factor authentication supported by partners including Google LLC's Authenticator (software) and Microsoft solutions. Cybersecurity advisories from National Institute of Standards and Technology, incident response firms including Mandiant, and non-profits like Information Technology Industry Council informed mitigation strategies. Corporate communications involved executives such as Marissa Mayer and legal teams from firms like Wilson Sonsini Goodrich & Rosati.

Aftermath and Legacy

The breach reshaped corporate cybersecurity practices across the Silicon Valley ecosystem, influencing legislation and standards referenced by bodies such as the National Institute of Standards and Technology and sparking academic research at institutions like Harvard University and Princeton University. It affected mergers and acquisitions involving Verizon Communications, informed investor due diligence in firms like BlackRock, and contributed to public debates led by media organizations including The New York Times and The Washington Post. Long-term effects included strengthened incident disclosure norms in jurisdictions such as the California Department of Justice-linked frameworks and catalyzed improvements in identity management used by services like Yahoo Mail and Flickr.

Category:Data breaches