PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yahoo disclosed two major, separate account-security incidents in 2016: a theft in August 2013 that was eventually estimated to affect approximately three billion accounts, and an intrusion in late 2014 that Yahoo said affected at least 500 million. The 2013 estimate changed as the company’s investigation developed; the 2014 case later raised a different issue, when the SEC said Yahoo’s security team knew of the breach within days but the company did not tell investors until 2016.
How the two Yahoo incidents compare
| Incident | When it happened | When Yahoo disclosed it | Account estimate | What the cited sources establish |
|---|---|---|---|---|
| 2013 theft | August 2013 | December 14, 2016 | Initially more than one billion; revised in October 2017 to approximately three billion, or all Yahoo accounts then existing | Yahoo’s notices listed account information that could have been stolen. The 2017 update changed the estimated scope; Yahoo said it was not a new security issue. Yahoo’s December 2016 notice; Yahoo’s October 2017 update. |
| Late-2014 intrusion | Late 2014 | September 22, 2016 | At least 500 million | Yahoo described the affected account information, while DOJ later announced allegations about the intrusion and account access. The SEC separately addressed Yahoo’s knowledge and investor disclosure. Yahoo’s September 2016 notice; DOJ’s indictment announcement; SEC’s 2018 announcement. |
The estimates are not a single combined count: they refer to two incidents at different times. Yahoo’s approximately three-billion figure for 2013 was its revised estimate of all accounts then existing, not an additional three billion on top of the earlier estimate.
What Yahoo said was taken in the 2013 theft
When Yahoo announced the August 2013 theft on December 14, 2016, it said potentially affected information included names, email addresses, telephone numbers, dates of birth, MD5-hashed passwords, and, in some cases, security questions and answers. Yahoo said clear-text passwords, payment-card data, and bank-account information were not included in that theft. Yahoo’s notice
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why the estimate rose
Yahoo’s first public estimate was more than one billion accounts. On October 3, 2017, after new intelligence and forensic analysis, the company revised the estimate to approximately three billion accounts—all Yahoo accounts then existing. Yahoo characterized this as an update to the scope of the 2013 incident, not a newly discovered separate incident. Yahoo’s October 2017 scope update
#1 Best Overall
What Yahoo disclosed about the late-2014 intrusion
Yahoo announced the late-2014 incident on September 22, 2016, saying information associated with at least 500 million accounts had been stolen. Its notice said the investigation indicated that unprotected passwords, payment-card data, and bank-account information were not included in the affected system. Yahoo’s September 2016 notice
What DOJ alleged about the intrusion
In March 2017, the U.S. Department of Justice announced charges against four defendants in connection with the 2014 intrusion and related account access. Its account of the indictment alleged a conspiracy beginning in January 2014 involving two Russian FSB officers and two criminal hackers. DOJ described theft of information from at least 500 million Yahoo accounts, access to Yahoo’s Account Management Tool, and use of stolen database information and a capability to mint authentication cookies to reach selected accounts. It also alleged access to Yahoo and other webmail accounts, including accounts belonging to journalists, government officials, and private-sector employees. These are allegations in DOJ’s indictment announcement, not a finding that every allegation was proved at trial or that the 2013 theft involved the same actors. DOJ’s March 2017 announcement
When Yahoo knew about the 2014 breach—and when it told investors
The SEC’s 2018 account addressed Yahoo’s handling of the late-2014 breach, rather than the scope update to the 2013 theft. The SEC said Yahoo’s information-security team learned within days of the December 2014 intrusion that Russian hackers had stolen sensitive user information. According to the SEC, by December 2014 the team had identified theft involving at least 108 million user records and believed that a larger portion or all of the database might have been taken. The SEC also said senior management and legal staff received reports, but Yahoo did not adequately investigate its disclosure obligations. Yahoo did not disclose the incident to investors until 2016, more than two years after the intrusion. SEC’s April 24, 2018 announcement
Free tools Windows power users keep installed
One-click scans. No signup required.
The SEC settlement
On April 24, 2018, the SEC announced that Altaba, formerly Yahoo, had agreed to pay a $35 million penalty to settle charges concerning the failure to disclose the 2014 breach to investors. The SEC release states that Altaba neither admitted nor denied the findings in the order. This was a regulatory penalty, not a consumer settlement. SEC’s announcement
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Yahoo advised affected users to do
In its December 2016 notice about the 2013 theft, Yahoo recommended that users:
- Review other online accounts for suspicious activity.
- Change passwords and security answers reused from Yahoo.
- Avoid suspicious links and attachments in email.
- Be cautious about unsolicited requests for personal information.
These were Yahoo’s recommendations at the time of the notice, not a guarantee that any one step would prevent account compromise. The advice to change reused credentials remains relevant to anyone who still reuses an old Yahoo password or security answer; do not rely on an old password merely because it has not recently been used on Yahoo. Yahoo’s December 2016 notice
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
