Massive Yahoo Hack €? 500 Million Accounts Comprom ised

The FSB officer defendants, Dmitry Dokuchaev and Igor Sushchin, protected, =
directed, facilitated and paid criminal hackers to collect information thro=
ugh computer intrusions in the U.S. and elsewhere. In the present case, the=
y worked with co-defendants Alexsey Belan and Karim Baratov to obtain acces=
s to the email accounts of thousands of individuals.

Massive Yahoo Hack  500 Million Accounts Compromised
Download https://urluso.com/2wJb6c



As you consider your various accounts, think about which ones you no longer=
 need. It might be a good idea to close them. Otherwise, you may be offerin=
g up user names and passwords, not to mention whatever other personal infor=
mation those accounts hold, to the next hacker.

Hints of an epic breach came in summer, when a dark web dealer called Peace=
 offered 200 million usernames and passwords of Yahoo users on a Tor-based =
market called The Real Deal, as reported by Vice Motherboard. Rumours then =
emerged Yahoo was ready to admit the breach, but it's now confirmed the hac=
k was even bigger than first indicated.

Following rumors that an announcement was soon to come, Yahoo! said Thursda=
y that hackers managed to access data from at least 500 million user accoun=
ts in a cyberattack dating back to 2014.

The Yahoo "hacker for hire" Karim Baratov, charged with helping Russian int=
elligence officers access compromised Yahoo email accounts, received a sent=
ence of five years in prison, as well as a fine amounting to the forfeiture=
 of all his remaining assets.

Baratov, a 23-year-old Kazakh native, was a Canadian national at the time o=
f his arrest last year in Canada for his role in one of the largest breache=
s ever uncovered: the 2014 exposure of 500 million Yahoo email accounts.



According to the Justice Department's announcement of the sentencing, Barat=
ov's function in the caper was to hack the webmail accounts of "individuals=
 of interest to his co-conspirator who was working for the FSB" (Federal Se=
curity Service) and sending the account passwords to an FSB agent in exchan=
ge for money.

"It's difficult to overstate the unprecedented nature of this conspiracy, i=
n which members of a foreign intelligence service directed and empowered cr=
iminal hackers to conduct a massive cyber-attack against 500 million victim=
 user accounts," said Special Agent in Charge John F. Bennett in the announ=
cement. "Today's sentencing demonstrates the FBI's unwavering commitment to=
 disrupt and prosecute malicious cyber actors despite their attempts to con=
ceal their identities and hide from justice."

"Beginning no later than 2014," read the indictment released last year, "th=
e conspirators stole non-content information regarding more than 500 millio=
n Yahoo user accounts as a result of their malicious intrusion. The theft o=
f user data was part of a larger intrusion into Yahoo's computer network, w=
hich continued to and including at least September 2016. As part of this in=
trusion, malicious files and software tools were downloaded onto Yahoo's co=
mputer network, and used to gain and maintain further unauthorized access t=
o Yahoo's network and to conceal the extent of such access."

Baratov pleaded guilty in December to nine felony hacking charges, out of t=
he 48 charges he faced for his role in accessing the private email accounts=
 of journalists, U.S. and Russian government officials and private sector e=
mployees of financial, transportation and other companies. The Yahoo hacker=
 was arrested in Canada in March of last year; Baratov was the only defenda=
nt arrested and prosecuted of the four men indicted in the case.

500 million Yahoo users are discovering that not only might hackers know th=
eir names and email addresses (potentially helping criminals craft maliciou=
s attacks and phishing campaigns) but they also have their phone numbers an=
d dates of birth.

Earlier today, as rumours spread widely across the net that Yahoo was about=
 to officially confirm a massive data breach, there was a huge spike in tra=
ffic to this site coming to an article about how to better protect Yahoo ac=
counts.

another question is also if the detection is linked to recent 0-day vulnera=
bilities and tools which were stolen from NSA. Did yahoo realize they were =
hacked by NSA unpublished holes (probably used by hackers too)?

This latest disclosure triples the number of accounts compromised by the ma=
jor 2013 data breach that the company disclosed late last year. At the time=
, Yahoo said hackers had stolen data associated with 1 billion user account=
s; the new disclosure escalates that number to 3 billion.

As originally announced, hackers in the 2013 breach stole account informati=
on such as names, email addresses, phone numbers, birth dates as well as ha=
shed passwords and security questions and answers. Yahoo, now known as Oath=
, says in late 2016 it forced password changes for all accounts that haven'=
t done so since 2013 and invalidated old security questions and answers.

Over the course of 2016, Yahoo set and then beat its own record for the lar=
gest-ever disclosed data breach. Last September, Yahoo reported an incident=
 affecting 500 million accounts that took place in 2014. Then, in December,=
 came the disclosure of the 2013 hack, which was presented as "likely disti=
nct."

The four men engineered the intrusion into Yahoo beginning in January 2014 =
that compromised 500 million email accounts, the federal complaint alleges =
and together face 47 criminal charges, including conspiracy, computer fraud=
, economic espionage, theft of trade secrets and aggravated identity theft.

He also created an online marketing scheme that redirected Yahoo search res=
ults for erectile dysfunction drugs to another online website so he could e=
arn commissions. On another occasion, he used his access to the contacts in=
 30 million accounts to create a spam campaign, the feds say.

Though it had long stopped being the powerhouse that it once was, social me=
dia site MySpace hit the headlines in 2016 after 360 million user accounts =
were leaked onto both LeakedSource.com and put up for sale on dark web mark=
et The Real Deal with an asking price of 6 bitcoin (around $3,000 at the ti=
me).

Yahoo disclosed that a breach in August 2013 by a group of hackers had comp=
romised 1 billion accounts. In this instance, security questions and answer=
s were also compromised, increasing the risk of identity theft. The breach =
was first reported by Yahoo while in negotiations to sell itself to Verizon=
, on December 14, 2016. Yahoo forced all affected users to change passwords=
 and to reenter any unencrypted security questions and answers to re-encryp=
t them.

In November 2018, Marriott International announced that hackers had stolen =
data about approximately 500 million Starwood hotel customers. The attacker=
s had gained unauthorized access to the Starwood system back in 2014 and re=
mained in the system after Marriott acquired Starwood in 2016. However, the=
 discovery was not made until 2018.

In June 2012, LinkedIn disclosed a data breach had occurred, but password-r=
eset notifications at the time indicated that only 6.5 million user account=
s had been affected. LinkedIn never confirmed the actual number, and in 201=
6, we learned why: a whopping 165 million user accounts had been compromise=
d, including 117 million passwords that had been hashed but not "salted" wi=
th random data to make them harder to reverse.

In October 2013, 153 million Adobe accounts were breached. The data breach =
contained an internal ID, username, email, encrypted password and password =
hint in plain text. The encryption was weak and many were quickly resolved =
back to plain text, the password hints added to the damage making it easy t=
o guess the passwords of many users.

In February 2018, the diet and exercise app MyFitnessPal (owned by Under Ar=
mour) suffered a data breach, exposing 144 million unique email addresses, =
IP addresses and login credentials such as usernames and passwords stored a=
s SHA-1 and bcrypt hashes (the former for earlier accounts, the latter for =
newer accounts). In 2019, this sensitive data appeared listed for sale on a=
 dark web marketplace and began circulating more broadly, so it was identif=
ied and provided to data security website Have I Been Pwned.

Quora, a popular site for Q&A suffered a data breach in 2018 exposed the pe=
rsonal data of up to 100 million users.

The types of leaked data included personal information such as names, email=
 addresses, encrypted passwords, user accounts linked to Quora and public q=
uestions and answers posted by users. There was no evidence discovered that=
 anonymously posted questions and answers were affected by the breach.

MyHeritage, a genealogical service website was compromised, affecting more =
than 92 million user accounts. The breach occurred in October 2017, but was=
n't disclosed until June 2018. A security researcher discovered a file on a=
 private server containing email addresses and encrypted passwords. The sec=
urity team at MyHeritage confirmed that the content of the file affected th=
e 92 million users, but found no evidence that the data was ever used by th=
e attackers. MyHeritage earned praise for promptly investigating and disclo=
sing details of the breach to the public.

Though a slightly different type of data breach as the information was not =
stolen from Facebook, the incident that affected 87 million Facebook accoun=
ts represented the use of personal information for purposes that the affect=
ed users did not appreciate. Cambridge Analytica was a data analytics compa=
ny that was commissioned by political stakeholders including officials in t=
he Trump election and pro-Brexit campaigns. Cambridge Analytica acquired da=
ta from Aleksandr Kogan, a data scientist at Cambridge University, who harv=
ested it using an app called "This Is Your Digital Life". One of the most c=
ontroversial elements of this breach was that users did not appreciate or c=
onsent to the political usage of data from a seemingly-innocuous lifestyle =
app.=20

UpGuard's researchers also discovered and disclosed a related breach by Agg=
regateIQ, a Canadian company with close ties to Cambridge Analytica. Detail=
s about these discoveries can be found in our Aggregate IQ breach series (p=
art 1, part 2, part 3 and part 4).
 eebf2c3492