Hackers posted what appear to be login credentials for more than 453,000 user accounts that they said they retrieved in plaintext from an unidentified service on Yahoo. 
 
 The dump, posted on a public website by a hacking collective known as D33Ds Company, said it penetrated the Yahoo subdomain using what's known as a union-based SQL injection. The hacking technique preys on poorly secured Web applications that don't properly scrutinize text entered into search boxes and other user input fields. By injecting powerful database commands into them, attackers can trick back-end servers into dumping huge amounts of sensitive information. 
 
 To support their claim, the hackers posted what they said were the plaintext credentials for 453,492 Yahoo accounts, more than 2,700 database table or column names, and 298 MySQL variables, all of which they claim to have obtained in the exploit. 
 
 "We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat," a brief note at the end of the dump stated. "There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage." 
 
 In a statement published by TechCrunch, Yahoo representatives confirmed a breach that hit the site's Contributor Network (previously Associated Content) on Wednesday. The stolen data was contained in an "older file," and only about 5 percent of the exposed credentials were still valid on Yahoo. 
 
 "We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo! users and notifying the companies whose users accounts may have been compromised," the statement continued. "We apologize to affected users. We encourage users to change their passwords on a regular basis and also familiarize themselves with our online safety tips at security.yahoo.com." 
 
 Because many people use the same credentials for multiple accounts, Ars isn't identifying the address of the website that published the disclosure. But at time of writing, the URL wasn't hard to find. 
 
 The TrustedSec blog is reporting that the hacked service may be Yahoo Voices, aka Associated Content. That speculation is based on the string "dbb1.ac.bf1.yahoo.com" included in the dump. The subdomain is associated with the voice service, the post said. 
 
 Article updated to reflect TrustedSec now says the compromised property is Yahoo Voices. Later updated to add official comment from Yahoo. ||||| Summary: Yahoo has confirmed that it has seen some 400,000 of its accounts compromised. The company has downplayed the issue, however, saying that the majority of the credentials are invalid. 
 
 Update on July 13 - Yahoo fixes flaw behind 450,000 account hack 
 
 Yesterday the hacker group D33ds Company claimed responsibility for attacking a Yahoo service via a union-based SQL injection and exposing 453,492 plain text login credentials. Last we heard, Yahoo was investigating the claims of accounts being compromised. To be on the safe side, the Web giant urged its users to change their passwords on a regular basis. Now, Yahoo has confirmed the breach. 
 
 See also - The top 10 passwords from the Yahoo hack: Is yours one of them? 
 
 "At Yahoo! we take security very seriously and invest heavily in protective measures to ensure the security of our users and their data across all our products," a Yahoo spokesperson said in a statement obtained by TechCrunch. "We confirm that an older file from Yahoo! Contributor Network (previously Associated Content) containing approximately 400,000 Yahoo! and other company users names and passwords was stolen yesterday, July 11. Of these, less than 5% of the Yahoo! accounts had valid passwords. We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo! users and notifying the companies whose users accounts may have been compromised. We apologize to affected users. We encourage users to change their passwords on a regular basis and also familiarize themselves with our online safety tips at security.yahoo.com." 
 
 The most important part of this confirmation is that the swiped file is "old" and Yahoo believes less than 5 percent of the credentials are valid. This means less than 22,500 users are affected by this breach, according to Yahoo anyway. 
 
 Hopefully some of them have already changed their passwords. In fact, if you have a Yahoo account, you should change your password, just to be on the safe side. Furthermore, if you use the same e-mail address and password combination elsewhere, you should change it there as well. 
 
 It's also worth noting that Yahoo Voices, the purported service that the accounts were used for, is not explicitly mentioned. It's all one and the same: Yahoo Voices is the name that consumers see, Yahoo Contributor Network is what the company refers to it internally, and Associated Content is what the service was called when Yahoo acquired it in 2010. 
 
 Update on July 13 - Yahoo fixes flaw behind 450,000 account hack 
 
 See also:
– A hacking collective posted the login credentials of a whopping 453,000 Yahoo users online yesterday, saying they'd swiped them from a Yahoo subdomain using a technique that only works on poorly-secured Web apps that don't monitor text entered into various user input fields, Ars Technica reports. "We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat," the hacker group, known as D33D Company wrote. "There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure," the group added. Yahoo confirmed the breach today, saying it came from an "older file" in the Yahoo Contributor Network—formerly known as Associated Content, ZDNet reports. But it said only 5% of the passwords the group posted were still valid. The company said it was working to fix the vulnerability, and change the passwords on affected accounts.