200 million Yahoo account details 'published on dark web'
Email details for sale on the dark web for just £1,400, hacker says


Peace, the hacker behind the Myspace and LinkedIn data dumps, has put what they claim are the details of 200 million Yahoo accounts up for sale on the dark web.
The asking price for the logs, which according to published sample include usernames, hashed passwords, dates of birth and in some cases backup email addresses, is three bitcoins, which equates to 1,373 at the time of writing.
Peace was also behind the sale of 117 million LinkedIn and 360 millionMySpace details earlier this year, which appeared on the same dark net site as this current batch. It is unclear, however, whether the person hacked the database themselves or has simply collated details that were already circulating.
In the 'advert' for the haul, Peace says the credentials are from "2012 most likely", indicating they do not know themselves quite what it contains in terms of age. This could mean a number of the accounts are defunct.
In a statement provided to IT Pro, Yahoo neither confirmed nor denied the validity of the alleged stolen credentials, saying: "We are aware of a claim. We are committed to protecting the security of our users' information and we take any such claim very seriously. Our security team is working to determine the facts. Yahoo works hard to keep our users safe, and we always encourage our users to create strong passwords, or give up passwords altogether by using Yahoo Account Key, and use different passwords for different platforms."
This is the second time what is claimed to be stolen Yahoo credentials have gone on sale on the dark net this year. In May, the details of tens-of-millions of Yahoo, Gmail and Hotmail accounts were discovered by Hold Security on a Russian dark net site.
The accounts "were put on sale for 50 roubles - or just over 50p", according to Express, the online arm of the Daily Express and Sunday Express. The website did not make it clear whether this referred to 50 roubles for each account, or 50 roubles for the entire haul.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
In July, Verizon announced it is to acquire Yahoo's advertising and search business for $5 billion. However, the deal does not include its email service. Yahoo intends to kill off passwords, replacing them with a new account login process that sends users a push notification to their smartphone whenever they want to log into their accounts.
This article was originally published on 2 August 2016 at 11.00am and has since been updated to include comments from Yahoo.

Jane McCallion is Managing Editor of ITPro and ChannelPro, specializing in data centers, enterprise IT infrastructure, and cybersecurity. Before becoming Managing Editor, she held the role of Deputy Editor and, prior to that, Features Editor, managing a pool of freelance and internal writers, while continuing to specialize in enterprise IT infrastructure, and business strategy.
Prior to joining ITPro, Jane was a freelance business journalist writing as both Jane McCallion and Jane Bordenave for titles such as European CEO, World Finance, and Business Excellence Magazine.
-
LaunchDarkly to "double down" on observability with Highlight acquisition
News Highlight's observability tools will be integrated into LaunchDarkly's Guarded Releases software deployment service
By Daniel Todd
-
Samsung Galaxy Tab S10 FE review
Reviews The Tab S10 FE retains the feel and core capabilities of Samsung's high-end S10 tablets, but compromises on the display and the performance
By Stuart Andrews
-
The worst hacks of all time
In-depth Yahoo, LinkedIn, Facebook, here is a quick guide to some of the biggest data breaches in history
By Rene Millman
-
Yahoo handed £250,000 fine over 2014 data breach
News ICO punishes Yahoo's UK arm for failing to protect 515,000 Brits
By Adam Shepherd
-
Canadian pleads guilty to Yahoo hack
News Karim Baratov was paid by Russian security agents to break into Yahoo accounts in 2014
By Dale Walker
-
Russia denies it's responsible for Yahoo hack
News The Kremlin said there's "absolutely no question of any official involvement by any Russian agency"
By Clare Hopping
-
Verizon knocks $350m off Yahoo deal
News Yahoo will also need to pay half of any liabilities incurred as a result of massive data breach
By Clare Hopping
-
Yahoo email scandal could derail Safe Harbour replacement
News Reports of mass email surveillance prompt fears of rights infringements
By Jane McCallion
-
Individual sues Yahoo over data breach
News New York man has accused Yahoo of gross negligence
By Clare Hopping
-
Yahoo hack: what your business needs to know - and why you shouldn't panic
Analysis The Yahoo hack is frightening, but the worst of the attacks are likely already over
By Nicole Kobie