Yahoo said hackers stole personal information from 500 million of its user accounts, a massive security breakdown it attributed to a “state-sponsored actor.” The breach disclosed Thursday, marking the latest setback for the beleaguered internet company, dates back to late 2014.
That’s when high-tech thieves hacked into Yahoo’s data centers, the company said. But Yahoo only recently discovered the break-in as part of an ongoing internal investigation.
The stolen data include users’ names, email addresses, telephone numbers, birthdates, hashed passwords and the security questions — and answers — used to verify an account holder’s identity.
Last month, the tech site Motherboard reported that a hacker who uses the name “Peace” boasted that he had account information belonging to 200 million Yahoo users and was trying to sell the data on the web.
Yahoo recommends that users change their passwords if they haven’t done so since 2014. The Sunnyvale company said its investigation so far hasn’t found any evidence that information about users’ bank accounts or credit and debit cards was swiped in the hacking attack. It said it has “no evidence” that the attacker is still in Yahoo’s network.