Yahoo Data Breach: A Timeline of the 3 Billion Account Hack

The first public word of the Yahoo data breach came on September 22, 2016, two months after Verizon agreed to buy Yahoo's web business for $4.8 billion, Al Jazeera reported. Yahoo said a "state-sponsored actor" had taken data from at least 500 million accounts in late 2014. It was not the whole story. Over the next 12 months, the company found an older theft from 2013, and the count for that one finally reached every account it had.

This case study follows the story in date order, because the dates are the lesson. The sections below cover:

• A full timeline, from the first theft in 2013 to the court-approved user settlement in 2020
• How the attackers turned a stolen database copy into account access without passwords
• What was taken, what it cost Yahoo, and who has been charged
• Why the security team's early warning never reached investors
• Seven defensive lessons you can apply to your own accounts or your company's systems

What Was the Yahoo Data Breach?

The name covers two separate thefts. The first, which this article calls the Yahoo hack 2013, happened in August 2013. The second, the Yahoo 2014 breach, happened in late 2014. Yahoo itself said in its December 14, 2016 statement that the two incidents were likely separate.

Both thefts took account records rather than money. A typical record held a name, email address, phone number, date of birth, a protected form of the password and, for many users, a security question and answer. Yahoo said card numbers and bank details were not in the affected systems.

What makes the case unusual is not one clever trick. It is the gap between what happened and what the public learned. The 2014 theft was disclosed almost two years later. The 2013 theft was disclosed three years later, and its size was revised upward twice.

Yahoo Data Breach Timeline, 2013 to 2020

The dates below are US dates as given in the sources. Pakistan runs 9 to 10 hours ahead of California, so news released on a US afternoon usually reached Pakistani readers overnight or the next morning.

Read the table from top to bottom and one pattern stands out. Each public update arrived later, and was larger, than the one before. That is the core of this case.

How Did the Attackers Get Into Yahoo?

For the 2013 theft, nobody has published an answer. Yahoo said in December 2016 that it had not identified how that intrusion happened. Any detailed story you read about the 2013 entry point is guesswork.

The 2014 theft is better documented, because US prosecutors described it in their charges. According to the indictment, as summarized by Dark Reading, the intrusion had three parts:

1. A copy of the user database. The intruder took a backup copy of part of Yahoo's user database. It held usernames, recovery emails, phone numbers and the data needed to build login cookies.
2. An internal admin tool. The intruder also reached Yahoo's Account Management Tool, an internal system staff used to manage accounts.
3. Forged cookies. With those two pieces, the group created cookies for chosen accounts. A cookie is the small token your browser keeps after you sign in. A valid one lets you skip the password screen, so a forged one does the same for an intruder.

That third step is why forged cookies matter so much in this case. A password change does not help if the attacker never needs the password. Yahoo said in December 2016 that someone had studied its proprietary code to learn how to forge cookies, and that it had since invalidated them.

Notice what the attackers did with this power. Prosecutors said cookies were made for about 6,500 targeted accounts, not hundreds of millions. The mass theft provided the map. The forged cookies were used to open specific doors.

The 2013 and 2014 Breaches Side by Side

The two incidents are often blurred together in news coverage. The comparison below keeps them apart, because the evidence behind each one is very different.

The password column deserves a closer look. Yahoo said the 2013 records held passwords hashed with MD5. Hashing turns a password into a fixed string that should not be reversible. MD5, however, is old and fast, so weak passwords protected with it can be guessed quickly. Academic experts told Reuters, as reported by VOA, that the stolen data was protected by outdated, easy-to-crack encryption.

What Was Taken, and What Did It Cost?

The Yahoo 3 billion accounts figure is the part of the Yahoo data breach most people remember. Yahoo itself noted that this count includes many accounts that were opened but rarely or never used, so the number of real people affected is lower. Nobody has published a precise figure for people rather than accounts.

The money side is easier to pin down:

• Deal price. Verizon cut its offer by $350 million in February 2017 because of the breaches, and paid $4.48 billion for the core business, Reuters reported.
• US securities penalty. The SEC fined Altaba $35 million in April 2018. Altaba neither admitted nor denied the findings.
• UK penalty. The Information Commissioner's Office fined Yahoo UK Services £250,000 over 515,121 UK accounts, according to The Register. The old UK law capped such fines at £500,000.
• User settlement. A $117.5 million class settlement covered about 194 million class members, the National Law Review reported. That works out to roughly 60 cents per member.

The hidden cost was trust. Users who reused a Yahoo password, or used the same security answer elsewhere, carried that risk into other accounts for years.

Who Is Responsible, and What Proof Exists?

When you read about blame for the Yahoo data breach, separate three levels of certainty.

Confirmed in Court

Karim Baratov, a Canadian and Kazakh national arrested in Canada in March 2017, pleaded guilty to nine charges. A judge in San Francisco sentenced him to five years in prison on May 29, 2018, KTVU reported. Prosecutors said he hacked webmail accounts, including dozens outside Yahoo, for an FSB officer in exchange for money. Reports on his fine differ. KTVU gave a figure of $250,000, while Dark Reading described the fine as equal to his remaining assets. The gap may reflect different stages of the case, so treat the exact amount with care.

Charged but Never Tried

The March 2017 indictment named two officers of Russia's FSB intelligence service, Dmitry Dokuchaev and Igor Sushchin, and a hacker named Alexsey Belan. All three are believed to be in Russia and have not faced a US court. Under US law they are accused, not convicted. These are allegations from prosecutors, however detailed.

Not Publicly Attributed

No government or company has publicly named who carried out the 2013 theft. Yahoo linked some forged-cookie activity to the same state-sponsored actor behind the 2014 incident, but it did not say that actor stole the 2013 database. Be wary of any source that treats both breaches as the work of the same people. That link has not been shown publicly. If you want to compare how attribution was handled in other state-linked cases, the PSTA case study on the SolarWinds hack is a useful contrast.

Why Did Disclosure Take Almost Two Years?

This is the core lesson of the Yahoo data breach, and it has little to do with hacking skill.

According to Yahoo's board committee, as reported by TechCrunch, the security team found the 2014 intrusion in late 2014 and informed legal staff. The team believed only 26 accounts were involved and did not dig further. By December 2014 it knew that database backup files had been taken. The committee said the legal team had enough information to demand a deeper investigation but did not do so.

The SEC reached a similar view from the investor side. Its order said Yahoo learned of the theft within days and reported it to senior management and the legal department. Yet for two years its public reports mentioned only the general risk of breaches. The SEC also found Yahoo had no controls to make sure security reports were assessed for disclosure.

Two things followed in March 2017. The general counsel resigned without severance, and the board decided the chief executive would not receive her annual bonus. In short, a technical team saw part of the problem, and the organization failed to ask how big it was.

What Happened After the Disclosures?

Yahoo's own response, described in its December 2016 statement, focused on account safety:

• It required password changes for affected users.
• It cancelled unencrypted security questions and answers so they could no longer unlock accounts.
• It invalidated the forged cookies.
• It worked with law enforcement, which had provided the 2013 data files to Yahoo in the first place.

That last detail is easy to miss. Yahoo did not find the 2013 theft through its own monitoring. Data files reached it through law enforcement. Organizations that rely on outsiders to spot their breaches will always learn late, and the Yahoo data breach shows how late that can be.

The legal fallout ran for years. Yahoo faced at least 41 consumer class actions by mid-2017, Reuters reported. The SEC penalty came in 2018, the UK fine the same year, and the user settlement in 2020. Students who have read our Equifax data breach case study will see the same slow legal tail.

Why Does a 2013 Breach Still Matter to You in Pakistan?

Many people in Pakistan opened a Yahoo Mail address in the 2000s and early 2010s, for school, a first job or a social media sign-up. Some of those addresses are still the recovery email for bank, Facebook or freelancing accounts. That is the real risk today.

Old breach data, including records from the Yahoo data breach, does not expire. A date of birth, an old phone number and a security answer such as a mother's maiden name do not change. Scammers can combine such details with newer leaks, like the card data covered in our post on the Pakistan bank data breach, to sound convincing on a phone call.

Here is a quick self-check you can do today:

1. List every account that uses an old Yahoo address for recovery.
2. Replace that recovery address with one you check every week.
3. Turn on two-step verification on the email account you keep.
4. Change any security answer that matches a real fact others could know.

If something already feels wrong with a linked account, our guide to recovering a hacked WhatsApp account walks you through the next steps.

For businesses, the lesson is about process. A local software house, bank or hospital may not hold 3 billion records, but the same gap can open between a technical alert and a management decision.

Seven Data Breach Lessons From the Yahoo Case

These data breach lessons apply whether you run a home office or a security team. The card below summarizes them, and the list explains each one.

1. Measure the scope before closing an incident. Yahoo's team settled on 26 accounts. Ask what else the intruder could have reached, not only what you saw.
2. Treat backups as production data. The 2014 theft started with a backup copy. Encrypt backups and watch who copies them.
3. Flag large data transfers. The UK regulator said huge transfers of personal data should have been flagged for investigation.
4. Guard admin tools as tightly as the database. An internal account tool gave the attackers a second route in. Limit who can use such tools and log every action.
5. Retire weak hashing. MD5 was outdated for passwords. Use modern, slow password hashing and plan upgrades before an incident forces them.
6. Build a path from security to the boardroom. The SEC found Yahoo lacked controls to assess security reports for disclosure. Write down who must hear about an incident, and by when.
7. Stop trusting security questions. Answers like a birthplace can be found or stolen. For your own accounts, use two-step verification instead, or give a random answer you store in a password manager.

Tracing Breach Timelines in PSTA's Cyber Security Classes

Building a timeline like the one above is a real skill. Incident responders do it after every serious event, and it is one of the tasks students practice at PSTA.

Over 12 weeks, PSTA's beginner cyber security course assumes no security background at all. The modules move from the CIA triad and risk into common attacks, basic ethical hacking and network security, and later reach digital forensics, cyber law, malware analysis and spotting threats early. In one lab you investigate an incident, preserve the evidence and write up its timeline, the same kind of work this Yahoo case needed. You can attend on campus in Abbottabad or join online classes from anywhere in Pakistan.

Once the foundations feel solid, learners interested in authorized attack testing can continue with PSTA's penetration testing course. Planning exams too? Our list of beginner cyber security certifications explains where to start. For a recent case that unfolded over hours rather than years, compare this story with our Binance hack analysis.

Not sure which track suits your level? Ask the PSTA team through the course page before you enroll, and they can suggest where to start.

Clean Up One Old Email Account This Weekend

You do not need to fix everything at once. Pick the oldest email address you still own, sign in, turn on two-step verification and check which accounts use it for recovery. If you no longer need it, move those recoveries to your main inbox first. That one small task closes the kind of door the Yahoo data breach left open for millions of people.