The stolen Yahoo customers’ personal data

Last week Thursday, Yahoo – of “yahoo.com” fame – revealed to the public for the first time that the personal information of over 500 million of its customers was stolen by hackers in 2014. If you are a yahoo.com user or have registered on the company’s site for any purpose, chances are that your cherished […]

Last week Thursday, Yahoo – of “yahoo.com” fame – revealed to the public for the first time that the personal information of over 500 million of its customers was stolen by hackers in 2014. If you are a yahoo.com user or have registered on the company’s site for any purpose, chances are that your cherished personal data are in the hands of hackers and are being sold or have been sold to others. Yahoo blamed state-sponsored hacktivism. That is, some government out there was behind the hacking activity. The stolen information includes your names, email addresses, usernames, encrypted passwords, telephone numbers, birth dates, and your security questions. By extension, your connections to your banks and other financial services, social media, as well as your friends and family, have also now been compromised.
There are probably many questions running through your mind as you read this article. For example, did Yahoo know about the hacking incidence when it occurred two years ago, and is only coming clean now, “on time” before its buyer, Verizon, digs the dirt out in its routine before-purchase background checks? You will recollect that Yahoo has been having serious financial troubles for many years, and has had difficulties finding an entity that would acquire it. In July of this year, the American phone and telecom company Verizon, agreed to buy Yahoo for an estimated $4.8 billion. However, like you and I, Verizon had no knowledge of the hacking incidence until a day or two before it was announced to the public last week. (Obviously, the terms of the acquisition will have to be re-negotiated in the wake of the revelation; that is, if the deal doesn’t totally fall through.) Verizon spokesman Bob Varettoni has been quoted as saying that his company “had limited information and understanding of the impact.”
Keeping users in the dark, until it could no longer do so, Yahoo might have set itself up for problems – credibility issues, and probably lawsuits. The company might also have robbed users of the opportunity to take timely precautionary measures. For example, yahoo.com email users might have opted to switch to competing email servers, such as Google’s gmail.com for their addresses – of course on the assumption that gmail.com is safer. Although the precise gravity of not letting users in on the hacking incidence for two years is not yet known, some governments need to intervene on Yahoo’s rather deceptive disposition on this, and perhaps on other matters as well. Wither the love of customers? These statements would be relevant only if Yahoo had knowingly kept the hacking incidence away from customers. Having said the foregoing, it is not uncommon for companies to under-report breaches, or to delay reporting them for years.
If it is the case that Yahoo honestly did not know of the hacking incidence, which, given its enormity – the number of victims involved – and breadth of data stolen,  is considered by some to be one of the most serious cyberattacks ever, can a tech company like Yahoo be excused for the apparent lack of competence and/or diligence? If Yahoo could be that lax, what else could the company be goofing up on? In fact, although Yahoo threw out 500 million – which is quite huge by itself – as the number of affected customers, I am of the opinion that the scale is perhaps much larger; with the temptation to assume that the data of virtually all of Yahoo’s customers were comprised. Thus, if you were a Yahoo customer up until 2014 – even if you are not anymore – you will need to take the precautions that I’ll suggest later in this article. This is because folks tend to use identical authentication data across platforms in order to simplify their lives.
State-sponsored cyberattacks appear to be routine, based on what we read and hear in the news. China and Russia are usually implicated, though both countries routinely deny any involvements. In 2014, computer attacks on the US government’s Office of Personnel Management were believed to be the work of the Chinese government. However, bilateral talks between the US and China might have resulted in a slowing down of Chinese hacking activities, at a time when Russian activities are picking up. The hacking of the emails of the US Democratic National Committee early this year was blamed on Russia. Obviously, many global companies have been hacked: LinkedIn, Sony, and J.P. Morgan Chase are a few examples.
What to do now as a Yahoo customer? Since serious hackers could now unscramble encrypted passwords, encrypting is not the only answer. You could add a second layer of authentication to your online accounts by asking to receive a short code via text message or handset every time someone – including you – logs into your account from an unknown computer. Of course, you have to change your passwords and security questions now – and then – and avoid using similar ones on multiple accounts.