The company, with aid from three unnamed US intelligence officials, is now claiming that the two-year old data breach was performed by a “state-sponsored actor” but has not currently identified a country of origin or any specific groups or individuals. However, the officials believe the attack to be of a similar nature to previous hacks associated with Russian intelligence agencies.
Verizon acquired Yahoo in July to a sum of $4.8 billion, and the parent company is now telling news outlets and reporters that it learned of the attack “within the last two days” and only has a “limited amount of information” to share at this time.
Meanwhile, Yahoo has given a public statement saying “online intrusions and thefts by state-sponsored actors have become increasingly common across the technology industry.” The company said earlier this summer that it was investigating a recent breach involving the sale of 200 million user accounts in dark web markets. A cybercriminal with the alias “Peace” admitted to selling the accounts for over $1,800 last month (in the form of 3 bitcoins), including usernames, md5 hash passwords, birthdates and recovery email addresses.
“It is really worrying that a breach from 2014 can have gone undetected for so long,” says Professor Alan Woodward from the University of Surrey. “It is also surprising the public statement took so long to appear.”
As of now, the FBI and independent security research firms now admit the 2014 breach to be “the largest publicly disclosed cyber breach in history.” The parent company, Verizon, has said its driving force in purchasing Yahoo was to acquire the Internet company’s large user base while attempting to sell targeted advertisements to over one billion visitors of Yahoo-owned websites.
In July, AOL CEO Tim Armstrong told the advertising industry that the Yahoo-Verizon deal is all about “consumer scale of getting over a billion users” and claims the company’s goal within the next four years is to get “two billion users overall. In financial markets, however, the interim concern is whether the two companies will be able to address security liabilities without down-shifting its stock index ratings or the price of earnings per share.
The Verizon-Yahoo acquisition was announced in July and will close by the first quarter of 2017. Yahoo CEO Marissa Meyer says her immediate priorities consist of seeing the transaction through the close while also managing the company’s Asian investments and securities with several financial groups.