Security researchers are disturbed it took Yahoo three years to discover that details of over 1 billion user accounts had been stolen back in 2013.
It means that someone — possibly a state-sponsored actor — had access to one of the largest email user bases in the world, without anyone knowing. The stolen database may have even included information on email ids of U.S. government and military employees.
“It is extremely alarming that Yahoo didn’t know about this,” said Alex Holden, chief information security officer with Hold Security.
Yahoo said back in November it first learned about the breach when law enforcement began sharing with the company stolen data that had been provided by a hacker. At the time, the company was already dealing with a separate data breach, reported in September, involving 500 million user accounts.
However, this hacker was apparently sitting on another mother lode of stolen Yahoo data, but it’s still unclear how the theft occurred.
Holden, who investigates online black markets, said there was always chatter among underground dealers that someone had made away with a massive trove of information from the internet firm.
“Hackers allegedly had small samples, but they had never seen the full data set,” Holden said.
But the stolen data never appeared to be widely circulated to make a major profit, he said. It suggests that state-sponsored hackers may have been behind the breach, and wanted to keep the data secretly to themselves.
“This information would have been distributed widely if cyber criminals were involved,” Holden said. “But right now, that seems not to be the case, even two or three years later.”
Private security firm InfoArmor may have actually discovered details about the Yahoo data breach earlier this year. In September, the company claimed it had found a stolen database allegedly belonging to Yahoo that was obtained from elite hackers-for-hire.
Yahoo, however, didn’t comment on the company’s finding, making it unclear if the data was legitimate.
InfoArmor has claimed that a hacking team called “Group E,” likely out of Eastern Europe, breached Yahoo and sold the data in three private deals. At least one of the buyers was a state-sponsored actor, said Andrew Komarov, InfoArmor’s chief intelligence officer, in an email on Wednesday.
The security firm has shared its findings with law enforcement agencies in the U.S., U.K., Australia and Europe. It said the stolen database it found also has information relating to over 150,000 U.S. government and military employees. Backup email addresses included in the discovered dump contain .gov and .mil domain names, said Komarov, who called the Yahoo breach a “matter of national security.”
The stolen data “may allow the threat actors to identify government employees very quickly,” he said.
The FBI has only said its investigating the Yahoo hack, and on Wednesday, the agency didn’t provide any new details.
Yahoo also hasn’t mentioned who might have pulled off the intrusion, except to say an “unauthorized third party” was involved.
Still, the recent data breaches at the company highlight the need for the tech industry to constantly be on guard against cyber threats, a security expert said.
“The lesson is clear: no organization is immune to compromise,” said Jeff Hill, director of product management for security provider Prevalent, in an email. “Criminal actors can do significant damage in days and weeks; give them years, and all bets are off.”