All 3 Billion Yahoo Accounts Were Affected by 2013 Attack

That investigators did not discover the full extent of the 2013 incident before Verizon closed the deal to acquire Yahoo in June was surprising to outside cybersecurity analysts.

“Frankly, I don’t know how Yahoo got away with this,” said Jay Kaplan, a former Defense Department cybersecurity expert and senior analyst at the National Security Agency who is now the chief executive of the cybersecurity company Synack.

After Yahoo discovered that one billion accounts were affected, it should not have been a stretch to consider that all of the company’s user accounts had been compromised, he said. “My guess is that Yahoo was completely ‘owned’ across the board,” Mr. Kaplan said.

Verizon said in a statement Tuesday that, with the assistance of outside forensic experts, it had determined that all Yahoo’s user accounts were affected. The company said it would continue to work closely with law enforcement.

“Our investment in Yahoo is allowing that team to continue to take significant steps to enhance their security, as well as benefit from Verizon’s experience and resources,” Chandra B. McMahon, Verizon’s chief information security officer, said in the statement. The company said it did not have more to add beyond an additional fact sheet for users.

Yahoo was hit with several shareholder lawsuits after the breaches became public, and the disclosure that data on all of its accounts was compromised could increase financial liabilities for Verizon.

No one knows exactly what happened to the data after it was stolen in 2013. But last August, a hacking collective based in Eastern Europe quietly began offering Yahoo’s information for sale, according to intelligence gathered by InfoArmor, an Arizona cybersecurity company that monitors the darker corners of the web.

Advertisement

Continue reading the main story

Since then, at least three buyers — two known “spammers” and an entity that appeared more interested in using the stolen Yahoo data for espionage — paid about $300,000 each for a complete copy of Yahoo’s stolen database, InfoArmor said after Yahoo first disclosed the breach.

Cybersecurity professionals warned that because many of the three billion Yahoo accounts belong to people who use the same passwords for different sites and services, there is likely to be an escalation of email fraud and account takeovers. They added that anyone who had used Yahoo should be diligent about monitoring their personal accounts.

With the stolen data, fraudsters have a higher chance of gaining access to the victims’ bank accounts, said Frances Zelazny, the vice president of marketing at BioCatch, a security start-up. “Most people reuse passwords or make multiple versions of the same passwords that are easy to hack,” she said.

Yahoo maintains that the breaches in 2014 and 2013 are not related. But investigators believe the attackers behind the 2013 breach were Russian and possibly linked to the Russian government.

In March, the Department of Justice charged four men, including two Russian intelligence officers, with the 2014 breach. Investigators said the Russian government used stolen Yahoo data to spy on a range of targets in the United States, including White House and military officials, bank executives and even a gambling regulator in Nevada, according to an indictment.

The stolen data was also used to spy on Russian government officials and business executives, federal prosecutors said.

What made that theft particularly egregious, Justice Department officials said, was that the two intelligence officers who were indicted had worked for an arm of Russia’s Federal Security Service, or F.S.B., that is charged with helping foreign intelligence agencies track cybercriminals.

Continue reading the main story

Share and Enjoy

How a Las Vegas Concertgoer Returned to Scene of Carnage in Her Pickup Truck to Rescue Victims

Instead of racing home after surviving the terrifying storm of gunfire that rained down on a country music concert Sunday night in Las Vegas, Lindsay Padgett returned to the venue to take shooting victims to the hospital in her pickup truck.

The Route 91 Harvest country music festival became the scene of the deadliest mass shooting in modern U.S. history when 64-year-old Stephen Paddock sprayed a crowd of 22,000 with automatic gunfire from the 32nd floor of the Mandalay Bay Casino before turning a gun on himself. Fifty-nine people died and more than 500 were injured.

“You see things like this on TV, but you don’t ever think it will happen to you,” the 29-year-old Las Vegas resident tells PEOPLE. “It was surreal.”

The night started out perfectly, says Padgett, who watched the concert from the front row with her fiancé, Mark Jay, her two cousins and three friends.

“It was a great night,” she says. “We were having a blast.”

• Want to keep up with the latest crime coverage? Click here to get breaking crime news, ongoing trial coverage and details of intriguing unsolved cases in the True Crime Newsletter.

While country singer Jason Aldean was performing, she says heard popping sounds, then saw sparks and smoke.

“We were trying to figure out what it was,” she says. “Jason Aldean ran off stage and then everyone was yelling, ‘Get down!’ People were getting shot left and right.”

Unable to leave because they were so close to the front where it was packed with concertgoers, she and her friends huddled together on top of one another, not sure what to do.

“My friend kept looking at me and saying, ‘I don’t want to die,” she says.

Finally, when people near them were able to get up and flee, “we all just started running,” she says.

“I had called my mom to tell her that I love her and goodbye because I thought that was it,” she says.

She and her friends ran to a nearby airport hangar where they hid until they thought it was safe to leave.

• PEOPLE’s special edition True Crime Stories: 35 Real Cases That Inspired the ShowLaw Order is on sale now.

They went to get her pickup truck from a parking lot across the street from the venue when a man approached them, asking for help.

“This guy says, ‘We need your truck. We need to get people over to the hospital.’

I said, ‘Put them all in.’

They loaded the truck with five shooting victims – some in the cab and some in the flatbed.

“We were trying to get to the nearest hospital but the roads were blocked off,” she says.

They stopped when they saw an ambulance on the side of the road. Paramedics took three of the most critically wounded victims from her truck.

“My fiancé took out the kid who was shot in the back and he went to put him in ambulance,” she says. “The paramedics said to take him out right away. They said, ‘He’s dead.’ ”

After helping to load victims who were shot in the chest into the ambulance, “My fiancé picked up the guy who had died and put him back in the bed of the truck,” she says.

Another victim who had been shot in the leg stayed in the backseat of the truck. “Then we followed the ambulance to the hospital.”

After Jay helped the victims into the hospital, he and Padgett set out to return to the venue to try to help even more shooting victims. “We didn’t go right home. We wanted to go back to help more people. But so many roads were blocked off. We were having a hard time getting back there.”

So they headed instead to MGM Grand where her cousins were hiding.

While Padgett is relieved she and Jay were able to help the shooting victims, she says she will never forget this nightmarish night that stole the lives of so many.

“It was terrifying,” she says. “It was something that was out of a horror movie.”

Share and Enjoy