Yahoo is sending out warnings to its users that their accounts may have been compromised. Yahoo’s chief information security officer is telling users that forged cookies may have been used to access their accounts between 2015 and 2016.
“Our outside forensic experts have been investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password,” according to an email obtained by ZDNet. “Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account. We have connected some of the cookie forging activity to the same state-sponsored actor believed to be responsible for the data theft we disclosed on Sept. 22, 2016.”
In September last year, Yahoo revealed a data breach had affected more than 500 million users in late 2014. Three months later, that number grew to 1 billion affected users whose accounts were stolen in August 2013. The new warnings to users are believed to be tied to the same state-sponsored attacker.
The timing couldn’t be worse for Yahoo. The company will be purchased by Verizon for $250 million to $350 million less than the originally agreed upon price. That deal could come as soon as this week after Verizon stalled for months to get Yahoo to change the sales agreement to reflect the economic damage of the attacks.
Verizon plans to integrate Yahoo’s search, email, and messaging features into its AOL unit. It will also take advantage of Yahoo’s advertising tools.
You might consider logging into your Yahoo account weeks to see if you received a warning from the company about the data breach.
Yahoo recommends users be cautious of unsolicited communication, avoid clicking on links or downloading attachments from suspicious email accounts, and to use its authentication tool that eliminates the need for a password.
H/T CNBC