FP News Features

The Canadian Press - ONLINE EDITION

Yahoo confirms theft of 450,000 users' email addresses and passwords

By: Raphael Satter, The Associated Press

Posted: 07/12/2012 7:39 AM | Comments: 0 | Last Modified: 07/12/2012 7:17 PM

This file photo taken June 7, 2010, shows a sign for Yahoo! in New York. THE CANADIAN PRESS/AP, Mark Lennihan

LONDON - Some 450,000 Yahoo users' email addresses and passwords have been leaked because of a security breach, the company confirmed Thursday, adding that just a small fraction of the stolen passwords were valid.

The company said in a statement that an "old file" from the Yahoo Contributor Network was compromised Wednesday. Among the stolen emails and passwords were many from Yahoo's own email service along with those of other companies. The Yahoo Contributor Network is a content-sharing platform.

Yahoo said it is fixing the vulnerability that led to the disclosure, changing the passwords of affected Yahoo users, and notifying other companies whose users' accounts may have been compromised.

"We apologize to all affected users," the company statement said.

Technology news websites including CNET, Ars Technica, and Mashable identified the hackers behind the attack as a little-known outfit calling itself the D33D Company. The group was quoted as saying it had stolen the unencrypted passwords using an SQL injection — the name given to a commonly used attack in which hackers use rogue commands to extract data from vulnerable websites.

"We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call," the group was quoted as saying.

Online security experts said Yahoo might have done more to protect the stored passwords, with Ohio-based TrustedSec describing the Internet giant's decision not to encrypt them as "most alarming."

Nevertheless, the haul does not appear as useful to hackers as they might have thought. Yahoo cautioned that only 5 per cent of passwords associated with its account holders were valid.

It was not immediately possible to contact the Ukraine-registered website associated with D33D Company. Its contact form was inoperable Thursday, while an email address and a phone number attributed to the site's registrant appeared to be invalid.

Fact Check

Have you found an error, or know of something we’ve missed in one of our stories? Please use the form below and let us know.

* Required

In which story did you find the error? *
Please post the headline of the story or the title of the video with the error.
What was the error? *
Please post exactly what was wrong with the story.
What should we have written?
Please indicate your source for the correct information.
Who else should we interview to improve this story?
Please include any contact information you may have.
Can we contact you in the future for advice on stories about this topic?
Yes

No
First Name: *
Last Name: *
E–mail Address: *
This will only be used to contact you if we have a question about your submission, it will not be used to identify you or be published.
Phone: *
This will only be used to contact you if we have a question about your submission, it will not be used to identify you or be published.
Colour:
Are you blue? If you can see this, leave it blank and get some CSS support.
Enter the words that you see: * This is to prevent our forms from being filled out automatically.
You have failed to correctly identify the words in the box above. Please try again.

More FP News Features

Undock

You can comment on most stories on winnipegfreepress.com. You can also agree or disagree with other comments. All you need to do is be a Winnipeg Free Press print or e-edition subscriber to join the conversation and give your feedback.

Have Your Say

New to commenting? Check out our Frequently Asked Questions.

Have Your Say

Comments are open to Winnipeg Free Press print or e-edition subscribers only. why?

Have Your Say

Comments are open to Winnipeg Free Press Subscribers only. why?

The Winnipeg Free Press does not necessarily endorse any of the views posted. By submitting your comment, you agree to our Terms and Conditions. These terms were revised effective April 16, 2010.