If you’ve ever signed up for an account with Yahoo, there’s cause for concern. The company confirmed today, after Recode broke the story last night, that 500 million user accounts were breached in a massive hack. 
 
 That’s larger than the population of the United States and Mexico combined. 
 
 Yahoo says the attack likely included email addresses, passwords, names and phone numbers — not payment card data or bank account information. 
 
 But our email accounts are packed with personal information. We send people we trust our account details for all kinds of services over email, and whether it's as benign as a Netflix password or as potentially devastating as a pornography website login or credit card number, we expect our email accounts to be password-protected and private. 
 
 If you have a Yahoo account, here’s what you should do. 
 
 Change all your passwords 
 
 Not just your Yahoo account. Make a list of all the online accounts where you store sensitive information. Update all your passwords to make them long and strong. Be sure to give each separate account a unique password, too. No repeats. 
 
 The best way to keep track of all your new passwords is with a password manager, which stores all your account details in an encrypted vault on your smartphone and your desktop. You can find some great free or extremely cheap ones online. Do some digging and find an option that works best for you. 
 
 Review old emails, delete sensitive content and disconnect accounts 
 
 If your Yahoo account information is indeed for sale, someone can hack into your email and find information you’d rather keep locked safe. Search your emails for sensitive correspondence, delete liberally and empty the trash folder. 
 
 Then visit the account settings of services you’ve connected to your Yahoo account and disconnect them immediately. 
 
 Switch to Gmail or use encryption 
 
 Gmail is endorsed by security researchers for being a secure service that most people can trust. If you want an airtight layer of protection, you can always setup a PGP key so only the intended recipient can decrypt your emails. 
 
 Enable two-factor authentication for all accounts and update apps 
 
 If you want to log in to your accounts, you should be able to verify you’re the one trying to log in and not someone else. That means employing more than just an easily sharable password to authenticate your login attempt. 
 
 Most services offer the option to text a code to a phone number on file for your account so only a person with both your password and your cellphone can access. Make sure all your apps and services are fully updated to take advantage of any recent security improvements. 
 
 Don’t open shady emails 
 
 Hackers often try to bait people into opening emails or attachments that may contain malware. Don’t open the email if you’re unsure. And if you do open an email and then decide it might be a hacker, do not open the attachments. Delete it. ||||| Boohoo for Yahoo. State-sponsored attacker blamed for hack as users told to change passwords. 
 
 Yahoo CISO Bob Lord writes: 
 
 We have confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by what it believes is a state-sponsored actor. The account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers. The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation has found to be affected. Based on the ongoing investigation, Yahoo believes that information associated with at least 500 million user accounts was stolen and the investigation has found no evidence that the state-sponsored actor is currently in Yahoo’s network. 
 
 This doesn't look good at all. 
 
 500 million Yahoo users are discovering that not only might hackers know their names and email addresses (potentially helping criminals craft malicious attacks and phishing campaigns) but they also have their phone numbers and dates of birth. 
 
 Passwords (thankfully) were held in a hashed format, mostly using the strong bcrypt algorithm... but it seems that some unencrypted security questions and answers were also accessed by the hackers. These could be useful ammunition for any hacker attempting to break into Yahoo accounts, or interested in exploring whether users might have used the same security questions/answers to protect themselves elsewhere on the web. 
 
 In its defence, I fully expect Yahoo to emphasise that they believe a "state-sponsored attacker" was responsible for the breach. Unfortunately the company hasn't shared any information as to how it came to that conclusion. 
 
 I have no idea if they're right or not about the culprits being state-sponsored, but let me put it this way... 
 
 If I had to break the bad news that my company had been hacked, and that at least 500 million of its users had been put at risk, I would feel much happier saying that the attackers were "state-sponsored" than a bunch of 15-year-old spotty oiks from the wrong side of town. 
 
 In the eyes of the public, if a hack is state-sponsored then, well, "hey, who could have reasonably stopped that?" 
 
 If you think that, then I suspect Yahoo are pleased that you have come to that conclusion. Here's what they say in their statement: 
 
 An increasingly connected world has come with increasingly sophisticated threats. Industry, government and users are constantly in the crosshairs of adversaries. Through strategic proactive detection initiatives and active response to unauthorized access of accounts, Yahoo will continue to strive to stay ahead of these ever-evolving online threats and to keep our users and our platforms secure. 
 
 Yes, you can call me a cynic if you like. That's what 25 years in the computer security industry does to a man. And no, I'm not saying that it wasn't a state-sponsored attack. 
 
 It's also a little disappointing that Yahoo doesn't share when it first discovered that it had been attacked. 
 
 Murmurings of a serious data breach at Yahoo have been spreading for some months, but this is a bigger hack than anyone previously feared. 
 
 Earlier today, as rumours spread widely across the net that Yahoo was about to officially confirm a massive data breach, there was a huge spike in traffic to this site coming to an article about how to better protect Yahoo accounts. 
 
 My advice? 
 
 Reset your Yahoo password. Make it a strong, complex password - and make sure that you are not using the same password anywhere else on the net. Yahoo says it is recommending that all users who have not changed their passwords since 2014 do so. 
 
 If you were using the same password in multiple places, you need to get out of that habit right now. Reusing passwords is a disaster waiting to happen, and could allow hackers to crack open other accounts using the same credentials. 
 
 Invest in a decent password manager program to generate random, hard-to-crack passwords, store them securely and remember them for you. 
 
 Watch out for phishing emails that pretend to come from Yahoo. 
 
 And yes, if you haven't already done so, enable two-step verification on your Yahoo account. 
 
 For more information, check out Yahoo's blog post. 
 
 Frankly, the timing couldn't be worse for Yahoo - which is trying to sell itself to Verizon. ||||| Yahoo (YHOO) on Thursday afternoon disclosed a security breach involving at least 500 million customers, but questions are being raised about whether the internet company should have moved sooner to protect users. 
 
 News that Yahoo would disclose the hack was reported Thursday by Recode, which cited several anonymous sources close to the situation. Those sources describe the breach as “widespread and serious,” while declining to elaborate because of possible government investigations and potential lawsuits. 
 
 In early August, tech site Motherboard reported that a hacker who goes by the moniker “Peace” was selling information, including user names, birth dates and scrambled passwords, from 200 million Yahoo accounts. 
 
 “Consumers should be not be reading in the news something Yahoo hasn’t told them,” said Susan Grant, director of consumer protection and privacy at the Consumer Federation of America. “They should be hearing this from Yahoo, not only that we had this problem -- but also about what to do.” 
 
 In confirming the attack on Thursday, Yahoo said user account information was stolen from the company’s network in late 2014 by what the company called a “state-sponsored actor.” The data may have included names, email addresses, phone numbers, dates of birth and passwords. 
 
 Yahoo initiated an internal probe following a report in July of a hacker selling 280 million user credentials on the black market, but found no evidence to substantiate the hacker’s claims, according to a source close to the company. A deeper review by the company’s security team found evidence a date theft occurred in 2014, the source said. 
 
 Yahoo declined comment as to why the company had not notified users earlier. 
 
 Like other companies, Yahoo is subject to data-breach notification laws in effect in 48 states that require companies to alert customers within specific periods of time that their information has been compromised. 
 
 “There are sometimes exceptions for notification when there are good reasons for law enforcement purposes for not revealing,” said Grant. But in Yahoo’s case the data loss has already been revealed, she noted. 
 
 A complicating factor, both for companies and customers, is that notification laws can be ambiguous. In Yahoo’s home state of California, for instance, the statute stipulates only that “The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement.” 
 
 Beyond changing their passwords, Grant advised Yahoo users concerned their information might be compromised to go the government site identitytheft.gov and follow the prompts on what it calls a recovery plan. 
 
 The reports come as Yahoo looks to close a deal to be acquired​ by telecommunications giant Verizon (VZ​), which agreed in July to buy its internet business for $4.8 billion. 
 
 “It doesn’t appear Yahoo had hard enough defenses, and with a merger you have to worry about even more sensitive information being vulnerable, Grant said. “When there’s more information that can be potentially there for the taking, it raises concerns about the adequacy of the security.” 
 
 “Within the last two days, we were notified of Yahoo’s security incident. We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact,” said a Verizon spokesperson. “We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities.” 
 
 AOL did not return requests for comment. ||||| Verizon says it was alerted to incident within last two days 
 
 In July, Yahoo! Inc. received a report of a hacker claiming to have 280 million user account credentials for sale on the black market. An initial investigation found no evidence to back that up, according to a person familiar with the probe. ||||| CLOSE Yahoo's massive data breach could affect hundreds of millions of users. USA TODAY 
 
 Yahoo announced a new data breach. It's time to update passwords, but also beware phishing emails. (Photo: Justin Sullivan, Getty Images) 
 
 SAN FRANCISCO — Yahoo said Thursday an investigation had confirmed information associated with at least 500 million user accounts was stolen from the company in late 2014. 
 
 Yahoo users and others should immediately take steps to protect themselves, and stay vigilant for attempted add-on attacks in the coming days and weeks. 
 
 Yahoo also owns the photos sharing site Flickr and the blogging platform Tumblr. No Tumblr accounts were affected. However, some Flickr accounts might have been, as in some cases user’s Flickr and Yahoo IDs are linked. Yahoo is reaching out to those users. 
 
 Yahoo has 1 billion people globally who engage with one of Yahoo's properties each month. 
 
 Yahoo breach: 
 
 “I've actually changed my password since this breach in 2014, but regardless I'm never happy to hear about something like this,” said Mike Rhode of Arlington, Va., a user of Flickr and Yahoo Groups. “However, as a long term employee of the Federal Government, I've had my data compromised twice, and have largely resigned myself to this type of issue being an ongoing problem in today's world.” 
 
 Change passwords, security questions 
 
 Yahoo said it was notifying potentially affected users and taking steps to secure their accounts. That included invalidating unencrypted security questions and answers so that they could not be used to access an account. Yahoo will also ask potentially affected users to change their passwords. 
 
 Yahoo users who haven't changed their passwords since 2014 especially should immediately change not only their passwords but also their security questions, the company said. 
 
 Users should also consider enabling two-step authentication on their Yahoo accounts, to provide an extra and very strong level of security. This form of verification sends a text message or call to the user's phone with a code as a second verification step. The code which must be typed in before the account can be opened. 
 
 Instructions on how to enable two-step authentication in Yahoo are on its website. 
 
 Review non-Yahoo accounts 
 
 In addition, users need to think about passwords and security questions from other accounts on which they gave the same or similar information used for their Yahoo account and possibly change them as well. 
 
 Once hackers have access to ID and password information for one system, they routinely try the same combination against multiple other platforms to see which ones work, an easily automated process. 
 
 Users should avoid clicking on links or downloading attachments from suspicious emails that claim to be updates from Yahoo or others about the breach. 
 
 Hackers often use news of big breaches to conduct "phishing" campaigns, sending official-looking emails that make it seem as if Yahoo or other legitimate services are asking them to supply information or click through to a link to repair any damage — something legitimate services will not do. 
 
 When in doubt, call or email the company that appears to be sending the message separately, don't go through the email you've been sent. 
 
 Yahoo users should be cautious of all unsolicited communications that ask for personal information, the company said. 
 
 Finally, all users should review their online accounts for suspicious activity. That includes banks, credit card companies and hotel and airline loyalty programs. 
 
 Contributing: Mike Snider 
 
 Read or Share this story: http://usat.ly/2d0cNNL ||||| Ailing tech giant Yahoo knew about their data breach affecting hundreds of millions of accounts. The breach is among the largest on record. (Jhaan Elker/The Washington Post) 
 
 Yahoo on Thursday reported the largest data breach in history — affecting at least 500 million user accounts — months after first detecting signs of an intrusion that the company blamed on "state-sponsored" hackers. 
 
 The Web giant called on customers to change their passwords and institute other protective measures, but the largest fallout could be for Yahoo itself. The long-faltering company this summer agreed to sell its core business for $4.8 billion to telecommunications giant Verizon in a deal now clouded by news of the massive breach. Verizon said it learned of the incident only "within the last two days." 
 
 The timeline highlighted a dilemma created by hacks: Companies often take months or even years to report suspicions of breaches — if they report them publicly at all — holding the information back from customers, business partners and even potential new owners of a company. 
 
 [What you should do if you have a Yahoo account] 
 
 "The dark cloud this casts will be very long and will likely impact the merger agreement," Jeff Kagan, a Georgia-based telecommunications industry analyst, said in an email. "We'll just have to wait and see what happens next." 
 
 Yahoo learned of the incident in July, the same month it announced its deal with Verizon, a person familiar with the matter said, speaking on condition of anonymity to freely discuss the issue. 
 
 When asked, Yahoo declined to say whether it first learned of the hack before or after that deal was announced. 
 
 Yahoo ultimately revealed the breach after Recode, a news site focusing on Silicon Valley, reported Thursday morning that the ailing tech giant would confirm a data breach affecting hundreds of millions of accounts. 
 
 The total number of affected accounts, by reaching 500 million, gave it the dubious distinction of being the largest breach on record, said Paul Stephens of the Privacy Rights Clearinghouse. 
 
 [How data breaches grew to massive proportions in 11 years] 
 
 
 
 
 
 Stephens said that consumers must also take steps to take care of matters themselves, outside of their Yahoo accounts. "It's really important that individuals think long and hard about passwords as well as security questions and answers they used on Yahoo that they might have used somewhere else," Stephens said. "It's very important to remember that if that information is available to hackers, they are going to try and use it on other sites as well." 
 
 Yahoo reported that the intrusion apparently began in 2014. Company Chief Information Security Officer Bob Lord wrote in a blog post that names, email address, telephone numbers, dates of birth and answers to "security questions" may have been stolen but financial information such as credit card numbers apparently was not because that data was stored in a separate system. 
 
 "Yahoo is working closely with law enforcement on this matter," Lord wrote. 
 
 Sen. Mark R. Warner (D-Va.) chastised Yahoo for not reporting suspicions of a breach sooner and called on the federal government to impose stricter disclosure requirements for companies. Companies now face a messy patchwork of state disclosure laws but no federal standard for reporting about breaches, including when, how and who was affected. 
 
 "While its scale puts it among the largest on record, I am perhaps most troubled by news that this breach occurred in 2014, and yet the public is only learning details of it today," Warner said in a statement. "Action from Congress to create a uniform data breach notification standard so that consumers are notified in a much more timely manner is long overdue." 
 
 Although President Obama proposed a federal law in 2015 that would give companies 30 days to notify the public about a discovered hack, lawmakers have yet to approve a single national standard. 
 
 On Thursday, Sen. Richard Blumenthal (D-Conn.) called on investigators to determine whether Yahoo intentionally withheld information about the incident to "artificially bolster its valuation" by Verizon — a potentially serious act of deception. 
 
 The impact on Verizon's deal with Yahoo was not immediately clear. Major data breaches have become a routine event for corporate America and also for major government agencies and political groups. The Yahoo intrusion stands out for the sheer scale of the customers apparently affected, a legacy of the company's once-commanding position for Internet users who turned to the company for web searches, email accounts, user groups and news reports. 
 
 The Verizon deal was seen as a relatively soft landing for Yahoo, a company overtaken by competitors in nearly every one of its major businesses. 
 
 Verizon, in a company statement, said that it was monitoring news of the breach. "We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact," the company's statement said. "We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities. Until then, we are not in position to further comment." 
 
 The security breach is yet another bruise for the aging tech firm and chief executive Marissa Mayer, who joined Yahoo in 2012 to effect a turnaround and ended up having to sell the firm's core assets instead. 
 
 Microsoft's recent acquisition of LinkedIn, which came one month after the social network revealed it 167 million of its accounts had been breached, show a breach alone is not necessarily enough to derail a deal, said John Levallo, senior vice president at the public relations and strategic communications firm Levick. 
 
 But he said the tech giant will be hard-pressed to rehabilitate its overall reputation in light of this breach. 
 
 "Focus on the consumer and not the deal," Levallo said. "If I were in that boardroom at this moment in time, I would say we understand there's a huge deal on the table right now. But first address and resolve the issue for your consumers and the transaction will take care of itself." 
 
 Yahoo has had a poor security reputation in the past, one of the many things that Mayer has focused on since becoming chief executive. 
 
 Vice's Motherboard blog in August reported that Yahoo was investigating an alleged breach after the news organization found that a cybercriminal known as "Peace" claimed to be offering 200 million Yahoo user credentials for sale online. The data was advertised on the "dark web" — a part of the Internet accessible only through the use of special software such as the anonymous browsing tool Tor and often associated with illicit activities. 
 
 Staff writers Andrea Peterson and Ellen Nakashima contributed to this report. ||||| Now playing: Watch this: 500 million Yahoo accounts stolen 
 
 Hackers swiped personal information associated with at least a half billion Yahoo accounts, the internet giant said Thursday, marking the biggest data breach in history. 
 
 The hack, which took place in 2014, revealed names, email addresses, phone numbers, birth dates and, in some cases, security questions and answers, Yahoo said in a press release. Encrypted passwords, which are jumbled so only a person with the right passcode can read them, were also taken. 
 
 The internet pioneer, which is in the process of selling itself to Verizon, said it's "working closely" with law enforcement. It called the hackers a "state-sponsored actor," though it didn't identify a country behind the breach. 
 
 Yahoo urged users to change their passwords if they haven't since 2014. The company has 1 billion monthly active users for all its internet services, which span finance, online shopping and fantasy football. Its mail service alone has about 225 million monthly active users, Yahoo told CNET in June. 
 
 The hack serves as a reminder of how widespread hacking is and highlights the vulnerability of passwords. Cybersecurity specialists recommend using a different password for each account you have on the internet. Other experts are working on alternatives to passwords, such as biometrics like your fingerprint or retina. 
 
 "Cybercriminals know that consumers use the same passwords across websites and applications, which is why these millions of leaked password credentials are so useful for perpetuating fraud," said Brett McDowell, executive director of the FIDO Alliance, an organization that vets the security of password alternatives. "We need to take that ability away from criminals, and the only way to do that is to stop relying on passwords altogether." 
 
 Justin Sullivan, Getty Images 
 
 Verizon, which is paying $4.83 billion for Yahoo, said it was notified of the massive breach within the last two days. The telecommunications giant had "limited information and understanding of the impact," according to a statement. 
 
 "We will evaluate, as the investigation continues, through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities," Verizon said. 
 
 B. Riley & Co. analyst Sameet Sinha told The Wall Street Journal the breach was unlikely to affect the sale to Verizon. 
 
 Virginia Sen. Mark Warner, a member of the newly formed Senate Cybersecurity Caucus, criticized Yahoo for not discovering the breach when it originally happened in 2014. 
 
 "While we have seen more and more data breaches in the private sector in recent years, many of them affecting millions of consumers, the seriousness of this breach at Yahoo is huge," Warner said. 
 
 The Privacy Rights Clearinghouse, a nonprofit organization that tracks cybersecurity breaches, said the hack was the largest-ever publicly disclosed breach. 
 
 Yahoo has taken steps to protect its users, including invalidating security questions and answers, but the real risk lies in hackers using the passwords on other websites. 
 
 "We typically see a 0.1 percent to 2 percent log-in success rate from credential stuffing attacks, meaning that a cybercriminal using 500 million passwords to attempt to take over accounts on another website would be able to take over tens of thousands of accounts on most websites," said Shuman Ghosemajumder, Google's former click-fraud czar and CTO of Shape Security. 
 
 Facebook co-founder Mark Zuckerberg's Twitter account was hacked using a similar method after the passwords of more than 100 million LinkedIn members were leaked. 
 
 It will take Yahoo at least several months before it starts regaining users' trust, according to research from Alertsec. The encryption provider did a study that found about 97 percent of Americans lose trust in companies like Yahoo after massive data breaches. 
 
 "When a company has allowed their customers' data to fall into the hands of criminals, the resulting lack of trust is difficult to repair," CEO Ebba Blitz said in a statement. 
 
 On August 1, a hacker named "Peace" claimed to have breached 200 million Yahoo usernames and passwords from a hack in 2012, and offered to sell them on the dark web after trying to do the same with MySpace and LinkedIn accounts. 
 
 A person familiar with the situation said Peace's assertion prompted Yahoo to initiate an internal investigation. That investigation found no evidence that substantiated Peace's claim, but the investigating team found indications that a state-sponsored actor had stolen data in 2014. 
 
 Former Yahoo information security officer Jeremiah Grossman, now chief of security strategy at SentinelOne, said that internet companies, especially giants like Yahoo, face challenges protecting enormous computer networks because the networks offer so many points of entry to attackers. 
 
 "It's unsurprising when breaches, even of this magnitude, take place," Grossman said. "Yahoo certainly isn't the first. And they won't be the last." 
 
 
 
 This story was originally published at 6:30 a.m. PT. 
 
 Updates, 10:20 a.m., 12:09, 12:41, 2:08, 2:30, 3:10, 4:15 and 4:42 p.m. PT: Added details of the 2012 hack that affected Yahoo, LinkedIn and MySpace, and added statements from Yahoo and Verizon, and analysis from experts. 
 

– Yahoo broke the news to half-a-billion users Thursday that hackers breached its system and thus might know their passwords, security questions, phone numbers, and dates of birth. Yes, that's a "b" as in billion, making this the largest data breach ever, notes CNET. The company is blaming "state-sponsored" hackers for the 2014 breach, without offering specifics. Related coverage: What should users do? In addition to changing passwords and security questions, they might consider enabling two-step authentication. See Recode and USA Today for advice. The danger of the hack? The data "could be useful ammunition for any hacker attempting to break into Yahoo accounts, or interested in exploring whether users might have used the same security questions/answers to protect themselves elsewhere on the web," writes security expert Graham Cluley on his blog. Yahoo got wind of the breach when it heard in July of this year that someone was trying to sell account credentials for 280 million users on the black market. It looked into the allegation and found that the truth was actually much worse. See Bloomberg. Might this screw up Verizon's deal to buy Yahoo for $4.8 billion? In short, maybe. Yahoo isn't saying whether it learned of the hack before announcing the Verizon deal in July. For now, Verizon is saying only that it has "limited information and understanding of the impact." See the Washington Post. Did Yahoo move too slowly in alerting people? “Consumers should be not be reading in the news something Yahoo hasn’t told them,” says an official at the Consumer Federation of America. More at CBS News. Yahoo's message to users is here.