More than one billion Yahoo accounts may have been affected in a hacking attack dating back to 2013, the internet giant reveals.
Yahoo said it appears separate from a breach disclosed in September, when it revealed some 500 million accounts were accessed in 2014.
The company said names, phone numbers, passwords and email addresses were stolen, but not bank and payment data.
Yahoo, which is being taken over by Verizon, said it is working closely with the police and authorities.
When Yahoo disclosed in September the 2014 data breach, the internet giant said information had been “stolen by what we believe is a state-sponsored actor”. Yahoo did not say which country it held responsible.
The 2014 breach included swathes of personal information, including names and emails, as well as “unencrypted security questions and answers”.
Yahoo has come under pressure to disclose why it took so long for the breach to be made public.
The new breach raises fresh questions about Verizon’s $4.8 billion proposed acquisition of Yahoo, and whether the US mobile carrier will try to modify or abandon its bid.
If the hacks cause a user backlash against Yahoo, the company’s services would not be as valuable to Verizon.
In a statement, Verizon said that it would evaluate the situation as Yahoo investigates and would review the “new development before reaching any final conclusions”.
On December 14, Yahoo said that users should change their passwords and security questions.
About 500 million Yahoo users were hit by the 2014 hacking attack, the tech giant has confirmed.
The breach, the largest publicly disclosed in history, included swathes of personal information including names and emails as well as “unencrypted security questions and answers”.
According to Yahoo, the breach did not include any credit card data. The site said it believed the attack was state-sponsored.
In July, Yahoo was sold to Verizon for $4.8 billion.
News of a possible major attack on Yahoo emerged in August when a hacker known as “Peace” was apparently attempting to sell information on 200 million accounts.
On September 22, Yahoo confirmed the breach was far bigger than first thought.
The data taken includes names, email addresses, telephone numbers, dates of birth and encrypted passwords.
Yahoo recommended all users should change their passwords if they had not done so since 2014.
It said in a statement: “Online intrusions and thefts by state-sponsored actors have become increasingly common across the technology industry.”
Reuters reported three unnamed US intelligence officials as saying they believed the attack was state-sponsored because it was similar to previous hacks linked to Russian intelligence agencies.
Yahoo’s internet business has been sold to Verizon Communications for nearly $5 billion in cash.
It will be combined with AOL, another faded internet star, which Verizon bought in 2015.
The deal does not include Yahoo’s valuable stake in Chinese firm Alibaba.
The price tag for the deal is well below the $44 billion Microsoft offered for Yahoo in 2008 or the $125 billion it was worth during the dot.com boom.
Verizon said the deal for Yahoo’s core internet business, which has more than a billion active users a month, would make it a global mobile media company.
Yahoo CEO Marissa Mayer said: “Yahoo is a company that has changed the world, and will continue to do so through this combination with Verizon and AOL.”
In an email to staff, Marissa Mayer said she was “planning to stay”, adding: “I love Yahoo, and I believe in all of you. It’s important to me to see Yahoo into its next chapter.”
However, the takeover, which is due to be completed in early 2017, raises questions about whether the Yahoo brand could disappear.
AOL chief executive Tim Armstrong said the deal was about “unleashing Yahoo’s full potential”, and creating a major player in mobile media.
Together AOL and Yahoo will have more than 25 brands, including Yahoo Mail, Flickr and Tumblr as well as AOL’s Huffington Post and Techcrunch news sites.
Marissa Mayer, who took the helm at Yahoo in 2012, has made little progress in returning the company to profit.
Last week Yahoo reported a $440 million loss in Q2, but said the board had made “great progress on strategic alternatives”.
Verizon has agreed to buy AOL in a deal worth $4.4 billion.
Buying AOL will broaden the amount of advertising Verizon can sell and will increase video production.
AOL owns websites such as the Huffington Post, Techcrunch, Engadget, Makers and AOL.com.
Verizon is trying to become more of a one-stop shop for internet services and entertainment.
AOL, famous for posting compact discs for its services through thousands of letterboxes in the 1990s, still has two million customers for its slower dial-up internet service.
It also became memorable for its messaging service, which would greet users with an audio clip that would cheerfully announce “you’ve got mail!”.
In 2001, during the dotcom stock market bubble, AOL merged with Time Warner in a deal valued at more than $160 billion when it was announced. The deal was unwound in 2009 when AOL was split off into a separate company.
In 2014, AOL had only 0.74% of the $145 billion global digital advertising market, according to eMarketer. Market leader Google had 31.4% market share last year, followed by Facebook with 7.9%.
As well as automated advertising, Verizon said the deal would give impetus to its 4G wireless video and internet video ambitions, and feed into its plans for capitalizing on the so-called “internet of things”.
AOL CEO Tim Armstrong will continue to lead the company if the deal goes through – the transaction is subject to regulatory approval.
“We are excited to work with the team at Verizon to create the next generation of media through mobile and video,” Tim Armstrong said.
Verizon is offering $50 a share for AOL, compared with AOL’s closing price of $42.59 on May 11.
This website has updated its privacy policy in compliance with EU GDPR 2016/679. Please read this to review the updates about which personal data we collect on our site. By continuing to use this site, you are agreeing to our updated policy. AcceptRejectRead More
Privacy & Cookies Policy
Privacy Overview
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
