Yahoo issues more warnings in fallout from hacking
LONDON — Yahoo is warning its users of potentially malicious activity on their accounts between 2015 and 2016, the latest develop - ment in the internet company ’s i nvesti gat i on of a mega-breach that exposed 1 billion users’ data several years ago.
Yahoo confirmed Wednesday that it was notifying users their accounts had potentially been compromised but declined to say how many people were affected.
I n a s t a t e ment , Ya hoo tied some of the potential compromises to what it has described as the “state-sponsored ac tor ” responsible for the theft of private data from more than 1 billion user accounts in 2013 and 2014. The stolen data included email addresses, birth dates and answers to security questions.
The catastrophic breach r a i s e d q u e s t i o n s a b o u t Yahoo’s security and destabilized the company’s deal to sell its email service, websites and mobile applications to Verizon Communications.
The malicious activity that was the subject of the user warnings revolved around the use of “forged cookies” — strings of data which are used across the web and can sometimes allow people to access online accounts without re-entering passwords.
A warning message sent to Yahoo users Wednesday read: “Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account.” Some users posted the ones they received to Twitter.
“Within six people in our lab group, at least one other person has gotten this email,” Joshua Plotkin, a biology professor at the University of Pennsylvania, said. “That’s just anecdotal of course, but for two people in a group of six to have gotten it, I imagine it’s a considerable amount.”
The theft of Yahoo users’ personal data has spawned more than two dozen lawsuits from users, all of them seeking class-action status.