Yahoo data breach 2012: what happened and what to do

What happened

In July 2012, Yahoo Voices, a publishing service run by Yahoo, was breached through SQL injection. That's an attack that tricks a website's database into returning data it shouldn't. Have I Been Pwned (HIBP) dates the breach to 11 July 2012, added it on 4 December 2013 and lists 453,427 accounts.

HIBP describes the result as nearly half a million usernames and passwords disclosed in plain text. Reporting at the time said the attackers published the list, and that Yahoo first put the number at about 400,000. Later, Yahoo described an older file from its Contributor Network with approximately 450,000 user names and passwords, and said that less than 5% of those accounts had valid passwords.

Use HIBP's count when you cite a figure. The numbers in news reports from 2012 differ by a few thousand depending on when they were written.

Don't mix this up with Yahoo's later breaches

Yahoo reported other, much larger breaches in later years, and they involved different systems. This page is only about the 2012 Yahoo Voices incident.

What was exposed

Two things: email addresses and passwords. The passwords were stored in plain text, so there was nothing to crack. Anyone who got the file could read them.

That's the key point about this breach. Reports at the time said the list held addresses from other providers too, including Gmail. The password someone used for a contributor login might have been the same as their password for email.

What that lets criminals do

If you reused the password, an attacker can log in to the other account. This is called credential stuffing, and it works at scale because people reuse passwords.

Yahoo said less than 5% of the passwords were valid at the time. But the breach is now over a decade old, and a password that never changed is still a password that was published. If your old habit was one password everywhere, treat all of those accounts as at risk.

The company's response

Yahoo described the file as coming from an older Contributor Network system and said fewer than 5% of the passwords in it were valid. If your Yahoo account is still active and you haven't changed its password in years, now is the time.

What to do about an old breach

Change the passwords and turn on two-factor authentication. Then use a password manager so you never reuse one again.

It also helps to look at what the password protected. An old contributor login probably guards nothing of value, but the same password on your email account guards everything, because email is how you reset the rest. Fix the email account first, then work outward through banking, shopping and social accounts. A breach from 2012 is a good reason to do that housekeeping once and properly.