Yahoo Inc. investigating possible massive security breach

LATEST NEWS

Computerworld is New Zealand's only specialised information systems fortnightly.
Subscribe now for $100 (23 issues) and save more than 37% off the cover price!

Get the latest news from Computerworld delivered via email.
Sign up now

By Ellen Messmer | Framingham | Friday, 13 July, 2012 | 1 Comment

Yahoo Inc. says it's investigating what could be a massive data breach of more than 453,000 Yahoo user login credentials after claims by a hacker group calling itself D33D Company that they had broken into a Yahoo server, stolen them and dumped them.

IN THE NEWS: Feds slash $2.7 million online loan-fraud scheme

The Associated Press early today reported Yahoo's head of United Kingdom consumer press relations Caroline MacLeod-Smith as saying the company is looking into "claims" of a compromise of Yahoo user IDs but would not say more about the possibility of the massive data breach. The group D33D Company is claiming to have stolen them by means of a SQL injection attack, a common type of assault against vulnerable Web servers.

The alleged Yahoo passwords today were being spread about the Internet by others, with some analyzing them for content. The group claiming responsibility for the attack on Yahoo is quoted as saying they hope it will be a "wake-up call" for better security.

Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security.

Read more about wide area network in Network World's Wide Area Network section.

Comments

second sign-in verification In December of last year they made 2FA (two-factor authentication) available to their users calling it "second sign-in verification". With this any suspicious account sign-in attempt (not from your computer) you will be challenged by a second sign-in verification beyond the initial password validation. To confirm the legitimacy of the sign-in attempt, you or the hijacker will have to answer your account security question or enter a verification code that will be sent to your mobile phone. I use two factor authentications across a lot of my accounts. I feel a lot more secure when I can telesign in to my account. If you have activated this option you should be ok, but obviously you should still change your password. If you haven't done so# you might want to do so now through the Your Account Info page.
Posted by Owen at 5:14:57 on July 13, 2012

Flag abuse