Yahoo said on Wednesday it had discovered another major cyber attack, saying data from more than 1bn user accounts was compromised in August 2013, making it the largest such breach in history.

The number of affected accounts was double the number implicated in a 2014 breach that the internet company disclosed in September and blamed on hackers working on behalf of a government.

“An unauthorised party” broke into the accounts, Yahoo said in a statement posted on its website. The company believes the hacks are connected and that the breaches are “state-sponsored”.

Senators call Yahoo's delay in revealing breach of 500m accounts 'unacceptable'
Read more
The hackers used “forged ‘cookies’” – bits of code that stay in the user’s browser cache so that a website doesn’t require a login with every visit, wrote Yahoo’s chief information security officer, Bob Lord. The cookies “could allow an intruder to access users’ accounts without a password” by misidentifying anyone using them as the owner of an email account. The breach may be related to theft of Yahoo’s proprietary code, Lord said.

The company began to suspect the breach in November, when law enforcement approached the company with what a third party claimed was “user data;” Lord’s post suggests that the data included forged cookies.

“For years I have been urging friends and family to migrate off of Yahoo email, mainly because I watched for years as the company appeared to fall far behind its peers in blocking spam and other email-based attacks,” wrote security researcher Brian Krebs as news of the attack broke. “I stand by that recommendation.”

Yahoo said the stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers.

After Yahoo revealed the smaller – but still historic – security breach in September, six US senators sent Yahoo a letter demanding the company reveal exactly when it had learned of the intrusion. Vermont senator Patrick Leahy, ranking member of the senate judiciary committe, called for a hearing; no hearing has been scheduled thus far.

The senators, including Leahy, said they were “disturbed that user information was first compromised in 2014, yet the company only announced the breach last week.” The six legislators found the reveleation that “millions of Americans’ data may have been compromised for two years” to be “unacceptable.”

The company is being acquired by Verizon for $4.8bn but the sale has not been an easy one. In October, a report revealed that the company had cooperated with the NSA to scan users’ emails for keywords on behalf of the agency.

A Verizon lawyer, Craig Silliman, said that the September breach had clearly damaged Yahoo’s value and hinted that the damage ought to be reflected in the buying price. “I think we have a reasonable basis to believe right now that the impact is material and we’re looking to Yahoo to demonstrate to us the full impact,” Silliman told reporters in October. “If they believe that it’s not, then they’ll need to show us that.”

Email breaches remain especially vexing to users, since they can reveal bank and family details as well as passwords that users share between systems or have received in their email accounts. Password-sharing has become so common that databases of login information are often used by hackers to test for email-and-password combinations on retailer websites like Walmart or Amazon.

Payment card data and bank account information were not stored in the system believed to be affected, the company said. Yahoo is notifying all the users affected and asking them to change their passwords. Yahoo owns assets far beyond its popular webmail service and its news site: other properties include blogging platform Tumblr and photo-sharing site Flickr, as well as Yahoo Finance.

Source: Theguardian.com