Yahoo Inc said on Thursday that information associated with at least 500 million user accounts was stolen from its network in 2014 by what it believed was a “state-sponsored actor.”
The data stolen may have included names, email addresses, telephone numbers, dates of birth and hashed passwords, but may not have included unprotected passwords, payment card data or bank account information, the company said.
Yahoo said it was working with law enforcement on the matter.
Earlier in the day, technology news site Recode reported that Yahoo Inc will disclose details of a data breach this week that compromised the data of several hundred million users, citing unnamed sources familiar with the company’s plan.
It was not clear how such a disclosure might affect Yahoo’s plan to sell its email service and other core internet properties to Verizon Communications Inc for $4.8 billion.
Yahoo might have to force users to reset their passwords, the Recode report said, citing unnamed sources.
The report follows an 1 August story in the technology news site, Motherboard, that said a cyber criminal known as Peace was selling the data of about 200 million Yahoo users, but did not confirm its authenticity.
The Motherboard report was published a week after Verizon announced its deal with Yahoo.
Peace was selling that batch of data on the 200 million Yahoo users for 3 bitcoin, or around $1,860, according to Motherboard. The possibly compromised data includes user names, birth dates, some backup email addresses and scrambled passwords, Motherboard said.
(At The Quint, we are answerable only to our audience. Play an active role in shaping our journalism by becoming a member. Because the truth is worth it.)