Yahoo breach means hackers had 3 years to abuse user accounts

Elite hackers-for-hire or state-sponsored actors may have been involved, according to experts

yahoo mail
Credit: Peter Sayer/IDG News Service

Security researchers are disturbed that it took Yahoo three years to discover that details on more than 1 billion user accounts had been stolen in 2013.

THhe breach suggests that someone -- possibly a state-sponsored actor -- had access to one of the largest email user bases in the world, without anyone knowing. The stolen database may have even included information on emails of U.S. government and military employees.

“It is extremely alarming that Yahoo didn’t know about this,” said Alex Holden, chief information security officer with Hold Security.

Yahoo said in November it first learned about the breach when law enforcement began sharing with the company stolen data  that had been provided by a hacker. At the time, the company was already dealing with a separate data breach, reported in September, involving 500 million user accounts.

However, this hacker was apparently sitting on another mother lode of stolen Yahoo data, but it's still unclear how the theft occurred. 

Holden, which investigates online black markets, said there was always chatter among underground dealers that someone had made off with a massive trove of information from the internet company.

“Hackers allegedly had small samples, but they had never seen the full data set,” Holden said.

But the stolen data never appeared to be widely circulated to make a major profit, he said. It suggests that state-sponsored hackers may have been behind the breach and wanted to keep the data secretly to themselves.  

“This information would have been distributed widely if cyber criminals were involved,” Holden said. “But right now, that seems not to be the case, even two or three years later.”

Private security company InfoArmor may have discovered details about the Yahoo data breach earlier this year. In September, the company claimed it had found a stolen database allegedly belonging to Yahoo that was obtained from elite hackers-for-hire.

Yahoo, however, didn’t comment on the company’s finding, making it unclear if the data was legitimate.  

InfoArmor has claimed that a hacking team called “Group E,” likely out of Eastern Europe, breached Yahoo and sold the data in three private deals. At least one of the buyers was a state-sponsored actor, said Andrew Komarov, InfoArmor's chief intelligence officer, in an email on Wednesday.

The security firm has shared its findings with law enforcement agencies in the U.S., U.K., Australia and Europe. It said the stolen database it found also has information relating to more than 150,000 U.S. government and military employees. Backup email addresses included in the discovered dump contain .gov and .mil domain names, said Komarov, who called the Yahoo breach a "matter of national security."

The stolen data "may allow the threat actors to identify government employees very quickly," he said. 

The FBI has only said it is investigating the Yahoo hack, and on Wednesday, the agency didn’t provide any new details.

Yahoo also hasn't mentioned who might have pulled off the intrusion, except to say an "unauthorized third party" was involved.  

Still, the recent data breaches at the company highlight the need for the tech industry to constantly be on guard against cyber threats, a security expert said.

“The lesson is clear: no organization is immune to compromise,” said Jeff Hill, director of product management for security provider Prevalent, in an email. “Criminal actors can do significant damage in days and weeks; give them years, and all bets are off."

Computerworld's IT Salary Survey 2017 results
Shop Tech Products at Amazon