YAHOO has confirmed that cybercriminals were able to steal personal data – including name, address, and security questions – from all 3 billion Yahoo user accounts as part of an online hack back in 2013. Here’s how to change your password and protect your data.
Yahoo has confirmed that data from all 3 billion of its user accounts was stolen during a cyberattack that occurred in 2013.
The US company had previously admitted that the security breach resulted in the theft of personal information from one billion Yahoo accounts.
However, outside forensic experts working with Yahoo have now tripled the number of accounts it believes were compromised.
Personal information including real names, email addresses and security questions were stolen from Yahoo.
Yahoo, which is now part of Oath – a subsidiary of mobile network Verizon, has published a statement that confirms that passwords in clear text, payment card data, or bank account information was not stolen during the cyberattack.
It also said all affected customers have now been contacted.
Yahoo Chief Information Security Officer Chandra McMahon said: "Verizon is committed to the highest standards of accountability and transparency, and we proactively work to ensure the safety and security of our users and networks in an evolving landscape of online threats."
UK Information Commissioner Elizabeth Denham said her office was concerned by Yahoo's announcement and was investigating.
She said: "This is understood to include all UK Yahoo! account holders at the time. This gives us further cause for concern.
"It is very disappointing to see the company is apparently still uncovering additional problems despite the length of time since the breach occurred.
"We are talking to Yahoo! and have advised them to contact all customers affected as soon as possible.
"We continue to investigate alongside the relevant international authorities to ensure the data protection interests of UK customers are considered."
Following the hack last year, Yahoo recommended all users "review all of their online accounts for suspicious activity and to change their passwords and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account."
"The company further recommends that users avoid clicking links or downloading attachments from suspicious emails and that they be cautious of unsolicited communications that ask for personal information," it added.
Those with a Yahoo email account should be on the lookout for any suspicious-looking messages asking you to input any personal data from your account.
Earlier this year, cybercriminals took advantage of the online attack to try and trick Yahoo mail users into clicking onto phishing websites – mistakenly thinking it was a genuine URL from Yahoo looking to help secure online accounts.
If you're worried about the hack, it's worth checking the website haveibeenpwned.
Run by security researcher Troy Hunt – the free database tracks online breaches and allows anyone to check whether their email address has been included in a publicly-available leak.
In this instance, you'll need to enter your Yahoo email addresses to see whether your account has been affected.
The site will tell you when the breach occurred and exactly what information was impacted.
You can also sign-up for alerts tied to any of your email addresses, so you will be notified as soon as another breach is picked up by the site.
Yahoo is asking any users that have not changed their passwords in the last two years to do so now.
Open your Yahoo Account Info page, then click Account Security > Change Password.
Enter your new chosen password and hit Confirm. A confirmation will then appear, click Continue to finish the process.
Yahoo provides email accounts for a number of partners, including BT, Sky UK, Verizon, AT&T, Frontier, Rogers, Spark, and MTS.
If you use any of these service – change your password using these methods.
Always create a unique password for every one of your online accounts.
For example, take the first letter of each word in your favourite song lyric, phrase or poem – and use those letters, which appear like a random jumble, as your password.
A password manager is another way to generate and securely store unique passwords with letters, symbols and numbers.
Yahoo has published its own security tips on the official company's Tumblr platform.
It reads: "Change your password and security questions and answers for any other accounts on which you used the same or similar information used for your Yahoo account.
"Review your accounts for suspicious activity.
"Be cautious of any unsolicited communications that ask for your personal information or refer you to a web page asking for personal information.
"Avoid clicking on links or downloading attachments from suspicious emails."