{"id":1357,"date":"2016-09-23T13:45:59","date_gmt":"2016-09-23T17:45:59","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=1357"},"modified":"2016-10-07T13:12:37","modified_gmt":"2016-10-07T17:12:37","slug":"yahoo-breach-500m-affected","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/yahoo-breach-500m-affected\/","title":{"rendered":"500 Million Yahoo Accounts Hacked: Here’s What We Know"},"content":{"rendered":"

\"yahoo-data-breach\"<\/p>\n

Yahoo Inc.<\/span>\u00a0has confirmed<\/a> rumors of \u00a0a massive security breach affecting at least 500 million Yahoo Mail users in what is possibly the largest data breach in history.<\/p>\n

Breached account information may include\u00a0names, email addresses, telephone numbers, dates of birth, bcrypt<\/a> hashed passwords and encrypted or unencrypted security questions and answers, according to the official Yahoo Tumblr post<\/a> confirming the breach.<\/p>\n

Yahoo has said that stolen information did not include unprotected passwords, payment card data, or bank account information, as payment card data and bank account information are not stored in the breached system.<\/p>\n

In an official statement, Yahoo’s Chief Information Security Officer (CISO) Bob Lord blamed the attack on “state-sponsored” malicious actors, though just what state he means, and why they want access to Yahoo user accounts, is unclear. Yahoo is working closely with law enforcement on the matter, according to Lord’s statement.<\/p>\n

For many, Yahoo’s announcement comes as no surprise. In August, hackers were discovered trying to sell 200 million Yahoo accounts, and on Thursday morning Recode reported that the company was preparing to confirm\u00a0the breach reports. \u00a0But the announcement couldn’t possibly come at a worse time for Yahoo and its CEO Marissa Mayer, who is looking to complete a\u00a0$4.8. billion sale of Yahoo’s core Internet business\u00a0to media giant Verizon Communications.<\/p>\n

While many of the stolen passwords are bcrypt hashed, and thus well protected, Yahoo has strongly encouraged users to change their passwords, security questions and answers for Yahoo accounts and any other accounts that use the same or similar passwords and security questions.<\/p>\n

In the enterprise realm, the loss of unencrypted security questions and answers creates a large risk for businesses and organizations that rely on those techniques to enhance security for traditional credentials, according to Leo Taddeo, CSO of\u00a0Cryptzone\u00a0and\u00a0former Special Agent in Charge of the Special Operations\/Cyber Division of the FBI\u2019s New York Office.<\/p>\n

“The best defense is to deploy access controls that examine multiple user attributes before allowing access,” Taddeo told Solutions Review. “This type of “digital identity” makes it much harder for a hacker to take advantage of the type of information lost by Yahoo.”<\/p>\n
Widget not in any sidebars
\n

And watch this for the 10 Best Resources for Evaluating IAM solutions:<\/h3>\n