Yahoo breach 2013: the biggest leak in history, explained

In August 2013, someone broke into Yahoo's servers and copied the data of every user registered with the service. Three years later the company still did not know — or at least that is what it told the world. When the truth finally came out, in October 2017, the final number was staggering: 3 billion accounts compromised. To this day it remains the largest publicly confirmed data breach ever.

How the intrusion happened

The 2013 attack exploited Yahoo's internal authentication system. Rather than stealing passwords — which would have meant cracking them one by one — the intruders forged session cookies. A session cookie is the file your browser keeps after you log in; it is what tells the site "this one already authenticated, let them through". With access to the server keys, you can mint a fake cookie that Yahoo accepted as legitimate.

That meant direct access to any account, no password required. Whoever controlled the cookie-generation tool held the keys to the entire kingdom — no alarms, no failed login attempts, nothing that would draw attention in conventional logs.

The 2014 attack, separate from the first, took a different route: the hackers compromised the credentials of an employee with administrative access and walked away with data from at least 500 million accounts. Among what was taken: names, email addresses, dates of birth, phone numbers and security question answers — many of them with no encryption at all.

The forged-cookie mechanism is the same one exploited in modern session hijacking attacks. If you want to understand how that vector works in detail, see our article on session cookie theft and session hijacking.

Three years of silence — and the time bomb

Yahoo says it discovered the 2014 breach during investigations in 2016. In September 2016, the company officially disclosed that attack: 500 million accounts. The timing was terrible: in July, Verizon had announced it was buying Yahoo's internet business for $4.83 billion.

In December 2016 came the second announcement: a separate breach, from 2013, had affected 1 billion accounts. After several more months of external forensic investigation, in October 2017 Yahoo revised the number: 3 billion. The entire user base.

Why did Yahoo take so long to disclose the breach?

The official answer is that the company did not know the full extent. Post-incident forensics is complex, especially when the attacker mimics legitimate traffic — a forged cookie never triggers a wrong-password alert. But the US SEC fined Yahoo (by then operating as Altaba) $35 million in 2018 for failing to disclose in a timely manner, which suggests there was negligence on top of the technical difficulty.

Who was behind the attack

In March 2017, the US Department of Justice indicted four people over the 2014 breach:

• Dmitry Dokuchaev and Igor Sushchin — officers of the FSB (the Russian intelligence service), who coordinated the operation
• Alexsey Belan — a Russian hacker already wanted by the FBI for other crimes, responsible for the technical execution
• Karim Baratov — a naturalised Canadian born in Kazakhstan, paid to break into target accounts on other services using data stolen from Yahoo

Baratov was the only one arrested, in March 2017 in Canada. He pleaded guilty and was sentenced to 5 years in prison in 2018. The three Russians were never extradited — the US has no extradition treaty with Russia.

The motivation blended espionage (the FSB officers wanted access to the email of dissidents, journalists and US government employees) with ordinary financial crime (Belan used the Yahoo data for spam and credit card fraud). State intelligence and organised crime sharing the same infrastructure — a pattern that became a hallmark of Russian groups.

The impact on the Verizon sale

The revelations threw sand in the gears of the deal. Verizon first pushed for a $925 million discount and considered walking away entirely. In the end Yahoo accepted a $350 million reduction, closing the sale at $4.48 billion in June 2017. Marissa Mayer, Yahoo's CEO, gave up her annual bonus — a rare move in Silicon Valley.

The internet business was folded into Verizon and the remaining holding company was renamed Altaba, which spent the following years liquidating assets. Yahoo, as an independent entity, ceased to exist.

What was stolen and what the lesson was

The data compromised in the 2013 breach included:

• Full name and email address
• Date of birth and phone number
• Hashed passwords — mostly bcrypt, but some in MD5 (far easier to brute force)
• Security questions and answers, some stored with no encryption at all

The plaintext security answers were particularly destructive: anyone reusing the same answers on other services was exposed well beyond Yahoo. And questions along the lines of "your mother's maiden name" are, by definition, answers that never change — unlike a password.

The structural lesson here is the same one from Equifax in 2017: companies holding data at billion-record scale can live with an active intrusion for years without noticing, especially when the attack mimics legitimate traffic. Behavioural detection — not just signature analysis — would have made the difference.

For users, the most effective protection would have been what Yahoo only rolled out at scale after the scandal: real multi-factor authentication. A password plus a recovery email using the same password is not MFA — it is the same password twice.

What to do if you had a Yahoo account before 2016

Credentials from old breaches circulate for years on forums and through data brokers. If you had a Yahoo account before 2016, assume your data from that period is available to anyone who cares to look. Practical steps:

1. Check your email at haveibeenpwned.com — it indexes the Yahoo dump
2. Change any password you used on Yahoo that you also use elsewhere
3. Drop security questions wherever they are still offered — replace them with TOTP
4. Use a password manager to guarantee a unique credential per service

The passkey model structurally solves the problem Yahoo laid bare: with no password to steal, there is no hash to crack and no credential stuffing to be done. See how it works in our article on passkeys and FIDO2.