Data breaches have become all too common. Not a week goes by without news of some company or organization learning they cyber criminals have hacked them.

The breaches often compromise people's Social Security numbers, bank account numbers, email and physical addresses, credit cards, and other data. Such data theft leaves people open to issues such as identity theft.

Here are some of the worst hacks of all time.

1. Yahoo

Number of people affected: 3 billion

By far the worst hack of all time happened to Yahoo in 2013 when hackers compromised around 3 billion people’s data.

At the time, the figure was reported as just 500 million, still enough to make it the biggest hack in history. However, it would be another four years before Yahoo admitted the figure was closer to 3 billion.

The hacked data included names, email addresses, phone numbers, dates of birth, encrypted passwords, and unencrypted security questions.

The person responsible for the hack was Karim Baratov. He was later given five years in prison and had to pay the victims restitution and $2.25 million in fines. For its part, Yahoo had to pay out $50 million in damages and offer free credit monitoring services to millions of its users.

2. Marriott

Number of people affected: 383 million

The Starwood group of hotels, which includes Sheraton, W Hotels, Westin, Le Meridien, Four Points by Sheraton, Aloft, and St. Regis, had been compromised sometime in 2014. This was before the Marriott Hotel group acquired it in 2016. It wasn’t until 2018 that Marriot found evidence of a breach through an internal investigation.

This meant for four years, the company had been the victim of a hacking campaign on Starwood’s reservation system. Cyber criminals exploited an unpatched vulnerability to hack the system.

While it was initially thought the hack affected 500 million people, this final number was 383 million. The hackers stole names, addresses, phone numbers, credit card information, email addresses, and unencrypted passport numbers.

The UK’s Information Commissioner’s Office (ICO) fined the Marriott chain £99 million ($135.95 million). The ICO said that Marriott ``failed to undertake sufficient due diligence" during the acquisition and missed the vulnerability as a result.

3. Facebook

Number of people affected: 533 million

In April 2021, a hacker published 533 million users’ details on a low-level hacking forum. The data contained phone numbers, Facebook IDs, full names, previous locations, birth dates, relationship status, and biographies. It also includes some of their email addresses.

Facebook said the issue stemmed from a vulnerability it patched in 2019, so technically, the data was scraped from the website.

Alon Gal, chief technology officer of cyber crime intelligence company Hudson Rock, said in a tweet the data would still be of interest to cyber criminals.

4. LinkedIn

Number of people affected: 500 million

The scraped data of over 500 million LinkedIn profiles was put up for sale on a popular hacker forum in April 2021. The The hacker had already leaked two million records as proof of the existence of the much larger data treasure trove, according to reports by Cybernews.

The data included LinkedIn IDs, full names, email addresses, phone numbers, genders, links to LinkedIn profiles, and professional titles.

A spokesperson for LinkedIn said the posted data appeared to “include publicly viewable information that was scraped from LinkedIn combined with data aggregated from other websites or companies.”

5. Equifax

Number of people affected: 143 million

In 2017, Equifax disclosed personal information of more than 145 million people was compromised. While the breach was big, what stood out was the quality of the data hackers harvested.

In addition to full names, dates of birth, and addresses, some victims also had drivers' license numbers, credit card information, and Social Security numbers stolen.

Verizon, which originally paid nearly $9 billion to buy AOL and Yahoo, announced Monday that it’s selling them for $5 billion.

According to statements from both companies, the telecoms giant is unloading its media group, Verizon Media, to private equity firm Apollo Capital Management.

The sale of Verizon Media also includes websites such as TechCrunch, Engadget, Autoblog and Yahoo Sports.

Verizon retains a 10% stake in the overall media group, which will be named Yahoo. Verizon’s advertising technology arm is also part of the deal.

The sale marks the apparent end of Verizon’s unsuccessful attempts to turn itself into a major player in the digital content and online advertising market.

Verizon bought AOL for $4.4 billion in 2015, then bought Yahoo for $4.48 billion in 2016. It combined them under the name Oath before rebranding Oath as Verizon Media.

Both AOL and Yahoo started as pioneering success stories in the early days of the internet before each company fell on hard times.

AOL became a corporate giant by selling dial-up internet service to millions, but it faded as broadband replaced dial-up service. Yahoo was a hugely popular web portal and search engine, but its business suffered due to the rise of its competitor Google.

Apollo Capital Management is a private equity firm that owns the Venetian resort in Las Vegas, arts-and-crafts retail chain Michaels, and Cox Media. The company is no stranger to the tech space, as it also snapped up tech companies Shutterfly and Rackspace and.

The deal is expected to close in the second half of 2021. Verizon will reportedly turn its focus toward its 5G network once it officially purges its media arm.

A Canadian citizen who helped Russian agents break into Yahoo email accounts during its massive data breach in 2014 has pleaded guilty to charges brought by the US Justice Department.

Karim Baratov, a 22-year-old Canadian citizen, was detained in Canada in March after charges were issued for both his arrest, and that of two other Russian Federal Security Service (FSB) agents for their involvement in the theft of over 500 million Yahoo accounts in 2014.

Baratov is one of a number of hackers said to have been paid by FSB agents Dmitry Dokuchaev and Igor Sushchin to break into Yahoo's accounts in an effort to target information relating to Russian officials, industry executives and bankers, according to the indictment.

The actions of the hackers led to the largest data breach in industry history, the full scope of which was eventually revealed by Yahoo in September this year.

As part of his plea, Baratov also admitted to hacking over 11,000 email accounts for the FSB, as well as other clients during the period of 2010 and 2017.

Baratov has now pleaded guilty to charges of conspiracy to violate the Computer Fraud and Abuse act, aggravated identity theft, and for causing damage to protected computers. As part of his plea agreement, Baratov will face a yet-to-be-determined prison sentence and will be forced to pay a fine of up to $2.25 million (1.6 million).

He will be held without bail until his sentencing on 20 February 2018. Given his charge sheet, he could potentially face up to 24 years in jail.

"The illegal hacking of private communications is a global problem that transcends political boundaries," said US attorney Brian Stretch, announcing the guilty plea. "Cybercrime is not only a grave threat to personal privacy and security, but causes great financial harm to individuals who are hacked and costs the world economy hundreds of billions of dollars every year."

"With the assistance of our law enforcement partners in Canada, we were able to track down and apprehend a prolific criminal hacker who had sold his services to Russian government agents. This prosecution again illustrates that we will identify and pursue charges against hackers who compromise our country's computer infrastructure."

So far, Baratov is the only person to have been arrested, although the warrants against the FSB agents still stand.

09/11/2017:Yahoo's ex-CEO blames Russia for 2013 and 2014 hacks

The ex-CEO of Yahoo, Marissa Mayer,told a security hearing on Wednesday that Russia was behind the 2013 and 2014 cyber attacks.

Mayer described how Yahoo reported that attack in late 2014 to law enforcement, including the FBI, and then worked with the authorities to expose the hackers behind the attacks.

"We now know that Russian intelligence officers and state-sponsored hackers were responsible for highly complex and sophisticated attacks on Yahoo's systems," she said.

She said the Department of Justice and the FBI announced a 47 count indictment charging four individuals with crimes against Yahoo and its users.

Mayer stressed how seriously she views the threat of cyber attacks and said the company devoted substantial resources to security "with the shared goal of staying ahead of these sophisticated attacks and constantly evolving threats".

"Unfortunately while all of our measures helped Yahoo successfully defend against the barrage of attacks by both private and state sponsored hackers, Russian agents intruded on our systems," she said. "The threat from state-sponsored attacks has changed the playing field so dramatically that today I believe all companies, even the most well defended ones, could fall victim to these crimes."

Despite this, the ex-CEO of Yahoo told the committee that the company has not been able to identify how the attackers stole the data.

Karen Zacharia, Verizon's chief privacy officer, told the hearing that after Verizon had acquired Yahoo it obtained new information from a third party regarding the attacks and promptly conducted a review.

"Based on that review we concluded that all accounts, and not just a subset, were impacted by the 2013 security incident, said Zacharia. "Yahoo then provided further individual notices to the impacted users beginning on October 3rd 2017."

She stressed that the stolen information did not include social security numbers, passwords in clear text or sensitive financial information "like payment card data or bank account information".

Yahoo announced at the start of the month that all of its accounts were affected by the 2013 hack (see below) which tripled the number of victims affected. The breach was already considered to be the largest in industry history before the news, as the company had thought that only a billion users had been affected.

04/10/2017:Yahoo says all 3 billion user accounts were hit by 2013 hack

Yahoo announced on Tuesday that all three billion of its accounts were affected by a hack in 2013, tripling the number of victims of data breach already considered the largest in industry history.

In December last year Yahoo publicly disclosed that more than one billion user accounts had been affected by a breach on their systems, leading to $350 million being wiped off the takeover deal by Verizon.

However, Yahoo, a company formed during the earliest days of the internet, has now "obtained new intelligence" that suggests that all three billion of its user accounts were breached.

Announcing the results of a recent investigation, a company statement by Verizon subsidiary Oath said that stolen information included names and addresses, but that passwords stored in plain text, and credit card or transaction information remained secure. The company said it continues to work closely with law enforcement agencies and forensic experts.

"In 2016, Yahoo took action to protect all accounts, including directly notifying impacted users identified at the time, requiring password changes and invalidating unencrypted security questions and answers so that they could not be used to access an account," Yahoo said in the statement.

Unfortunately, experts claimed in December that encryption technologies used on the passwords were out of date and could be easily bypassed, and that password recovery questions and linked email addresses were included in the data dump, increasing the likelihood that other accounts could be targeted.

The new will likely have significant legal implications for Verizon, who secured Yahoo in June for $4.48 billion. As part of those terms, Verizon agreed to share regulatory liabilities for both the 2013 data breach, and a second data breach revealed to have affected 500 million accounts in 2014.

Verizon's CISO Chandra McMahon said that the company is "committed to the highest standards of accountability and transparency, and we proactively work to ensure the safety and security of our users and networks in an evolving landscape of online threats".

"Our investment in Yahoo is allowing that team to continue to take significant steps to enhance their security, as well as benefit from Verizon's experience and resources."

However, Yahoo currently faces as many as 43 class-action lawsuits from both the 2013 and 2014 hack, according to a company filing in May, a figure that is almost certainly going to increase. John Yanchunis, the lawyer representing Yahoo customers, said the cases had stalled because a federal judge required more information to legal justify the claims of his clients.

Speaking to Reuters, Yanchunis said: "I think we have those facts now. It's really mind-numbing when you think about it."

Rich Campagna, CEO at Bitglass, said that a hack affecting the entirety of a company's customer base is something unprecedented in the industry. "It's difficult to imagine any circumstance in which an organisation committed to security could have all network segmentation, policies, and security measures bypassed completely," said Campagna. "Even over a prolonged period of time, it is exceedingly difficult to exfiltrate three billion records without setting off a single actionable alarm."

In response to the news, US Senate chairman John Thune said that a hearing will be held later in the month that will cover two massive data breaches at both Yahoo and Equifax, according to Recode. In those reviews, the Senate will decide whether "new information has revealed steps they should have taken earlier, and whether there is potentially more bad news to come."

25/04/2017:Yahoo CEO Marissa Mayer will make $186 million from Yahoo sale

Yahoo CEO Marissa Mayer will earn $186 million through the sale of Yahoo to Verizon if the deal goes through, according tosecurities filings detailing the stocks and shares Mayer owns that do not include her salary or severance package.

Mayer owns Yahoo shares worth approximately $77 million, stock options valued at more than $84 million, and about $25 million of restricted-stock units, giving a total of $186 million. The current share price for Yahoo is $48.15, although the company has predicted it to fall to $38.59 when the deal goes through.

Shareholders were invited to attend a special meeting where they will vote on the proposed sale. This includes the golden parachute compensation, which Mayer and other executives will receive if the sale goes through, where Mayer will gain an additional $23,011,448.

Following the revelations of the Yahoo hacks affecting 1.5 billion users, Mayer lost a $9 million dollars off her severance package. When she first announced in January that she was going to leave the company, it was rumoured that she was going to make $53 million, although it turned out this was what she would have received if Verizon had forced her to step down.

Verizon's takeover of Yahoo is expected to close in June, after the data breaches knocked $350 million off the deal, leaving Verizon with a purchase price of $4.83 billion. While Yahoo will retain its brand under Verizon, it and AOL will form a new media division called Oath.

While Mayer will leave Yahoo, AOL boss Tim Armstrong will lead the division, which will also include TheHuffington Post, Techcrunch, Tumblr and Brightroll.

15/03/2017:Marissa Mayer gets $23m parting gift from Yahoo

Yahoo's departing CEO Marissa Mayer will receive $23 million from Verizon as she bids farewell to the search giant. Although it's a rather attractive figure, if Yahoo hadn't been hacked last year, she would have been taking home an extra $9 million.

The news was revealed in regulatory documents filed at the beginning of the week, which explained Mayer would be given $3 million in cash, $24,000 in benefits, and $19,971,367 in equity for her "golden parachute" payment.

The cash payment Mayer will receive comprises $1 million in salary payments, a $2 million bonus payment and $15,000 in "outplacement services".

However, when Mayer first announced her intentions to step down from the company, it was rumoured her payout would be almost double what she is getting at $53 million, but that amount would have been granted had she been sacked following the Verizon takeover rather than her resigning according to Gizmodo.

Other executives receiving "golden parachute" payouts are Ken Goldman who will be paid almost $9.5 million, Lisa Utzschneider with a $16.5 million payment and David Filo who will be presented with $66,415.

Marissa Meyer revealed she would be leaving Yahoo when the Verizon deal closed in January, although the value of the acquisition was decreased by $350 million as a result of the data breach that resulted in the company losing 200 million customer records.

Thomas McInerney, Yahoo board member and former CFO of IAC will take over from Mayer.

16/02/2017: Yahoo alerts users to new malicious account activity

Yahoo has issued fresh warnings to users about unauthorised activity on their accounts following a previously disclosed cookie forging campaign.

The troubled company, which is in the middle of an acquisition deal with Verizon, notified users on Wednesday that intruders had gained access to their accounts between 2015 and 2016, by forging cookies that act as saved passwords.

The cookie forging hack, which is a separate incident to the two massive data breaches in 2013 and 2014, involved intruders exploiting proprietary code to create fake cookies, granting access to accounts without the need of a password. But the warnings issued to users say that some of the cookie forging has been linked to the same hacker believed to be responsible for the breach of 500 million accounts in 2014.

"Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account," the email reads, according to the International Business Times. "We have connected some of the cookie forging activity to the same state-sponsored actor believed to be responsible for the data theft we disclosed on the 22nd September 2016."

The alerts appeared alongside news that Verizon had managed to shave off around $250 million from the $4.83 billion deal to acquire Yahoo, in the wake of the two previous data breaches, according to a report by Bloomberg citing sources close to the agreement.

"As we have previously disclosed, our outside forensic experts have been investigating the creation of forged cookies that could have enabled an intruder to access our users' accounts without a password. The investigation has identified user accounts for which we believe forged cookies were taken or used," a Yahoo spokesperson said in a statement sent toIT Pro.

"Yahoo is in the process of notifying all potentially affected account holders. Yahoo has invalidated the forged cookies so they cannot be used again."

IT Prounderstands that Yahoo's security investigation is in its final stages, with most affected users now notified.

Yahoo is currently under investigation by the US Securities and Exchange Commission, to assess whether the company acted soon enough to alert investors and the public to the discovery of the data breaches, which collectively affected around 1.5 billion users. It also faces probes from the US Federal Trade Commission and the FBI.

24/01/2017:Yahoo admits delay to Verizon deal

Verizon's takeover deal of Yahoo has been pushed back to the second quarter of 2017.

Yahoo has admitted the acquisition deal will no longer take place in the first three months of 2017, due to "work required to meet closing conditions", although the company is working "expeditiously to close the transaction as soon as practicable in Q2".

In a company earnings statement, Yahoo CEO Marissa Mayer described the past year, in which Yahoo disclosed two historic hacks affecting 1.5 billion users, as "uniquely eventful", but said upcoming opportunities with Verizon remain "bright".

Although the $4.8 billion deal is taking longer than predicted, the news is not all bad for Yahoo, which posted better-than-expected quarterly profits, including a 15% gain in revenue from this time last year.

Yahoo's fortunes have taken a turn for the better thanks to its thriving mobile and social advertising business Mavens, which saw a 25% rise in revenue to $590 million.

"I'm very pleased with our Q4 results and incredibly proud of the team's execution on our 2016 strategic plan," said Mayer. "We continued to build our mobile and native businesses, while operating the company at the lowest cost structure in a decade."

"Our top priority continues to be enhancing security for our users. Our commitment to our users is unwavering, and we continue to be encouraged by their loyalty to us and their ongoing patronage of our products," she added.

That loyalty has certainly been tested over the last few months, after Yahoo disclosed two of the largest data breaches in industry history, affecting more than 1.5 billion users. Although Yahoo has not provided specific reasons for a delay in the deal, continued fallout from those revelations are likely causing headaches for both sides, with Verizon rumoured to be seeking a lower sale price.

The US Securities and Exchange Commission is currently investigating Yahoo's practices to assess whether the company disclosed news of the hack soon enough to its investors and the public.

However, it appears from the latest earnings report that the company has been able to mitigate some of that fallout, managing to buck analyst expectations.

But the company did see losses, with gross revenue for Yahoo's search platform falling by 6% to $821 million, as the company struggles to compete against Google. Desktop revenue also fell to $3.46 billion for the full year, down from $3.5 billion in 2015. Of the 1 billion total users the company claims to have, 650 million of those use mobile devices.

23/01/2017:US authorities probe Yahoo hacks

The US Securities and Exchange Commission (SEC) has launched an investigation into the previously disclosed breach of user data at Yahoo, according to a company quarterly filing.

Yahoo stated it was "cooperating with federal, state and foreign" authorities in a filing from November 2016, first unearthed this week by theWall Street Journal,as agencies began investigations into a "security incident".

One of those agencies, the SEC, is assessing whether the company should have informed investors sooner after the discovery of two massive data breaches in 2013 and 2014, according to a report by the WSJ,citing anonymous sources close to the matter.

Yahoo made headlines in September 2016 when it reported a data breach affecting 500 million user accounts in 2014, and again in December 2016 when a second, more significant leak was discovered involving more than one billion users, dating back to 2013.

The SEC issued requests in December 2016 for information and documents, according to the sources, to discern exactly when Yahoo found out about the cyber attacks, and whether subsequent disclosures complied with civil security laws and SEC guidelines.

Following reports of the 2014 hack, US senator Mark Warner approached the SEC in September to request an investigation into Yahoo's practices and whether the company had fulfilled obligations to inform investors and the public.

Yahoo has yet to explain why it took almost two years to disclose the breach publically, despite having knowledge of the leak in 2014.

The SEC is among a number of authorities investigating the company, including the Federal Trade Commission and the US Attorney's Office in Manhattan, according to the filing. The sources have stated that the investigation is in its early stages, and it is currently unclear if further action will be taken against Yahoo.

The $4.8 billion take-over deal of Yahoo by Verizon has faced mounting pressure following the discovery of the breaches, and the subsequent sale of leaked data on the dark web. Verizon is still set to go ahead with the deal, but is likely to negotiate down the price before a final agreement is struck.

IT Pro has approached Yahoo for comment.

15/12/2016:Yahoo faces pressure from Verizon as accounts 'are sold on dark web'

Verizon has moved to secure a better deal on its acquisition of Yahoo's internet business, following this week's revelation that a 2013 hack affected more than one billion user accounts.

The US network firm first announced plans to buy Yahoo's business in July for $4.8 billion, but economic fallout from the discovery of two massive data breaches in 2013 and 2014 means the company is now seeking amendments to the original proposal.

The largest US wireless carrier is likely to go ahead with deal but seeks "major concessions" following recent news of the largest hack in industry history, according to Reuters sources close to the matter.

In October, Verizon stated it was reassessing the deal after the discovery of a hack in 2014 affecting 500 million user accounts. The latest hack has forced Verizon to "review the impact of this new development before reaching any final conclusions" on the deal.

Sources claim that Verizon is willing to go to court to renege on the deal if Yahoo does not adjust the offering price. Shares in the California-based internet service fell more than 6% on Thursday after news of a second data breach.

When asked about the deal, a Yahoo spokesperson told IT Pro: "We are confident in Yahoo's value and we continue to work towards integration with Verizon."

Pressure from Verizon came as reports suggest the leaked database affecting over 1 billion users has already been sold on the dark web.

The leak was first discovered by security researcher, Andrew Komarov, who found a leaked database of Yahoo user details being sold by a hacking group he had been tracing based in Eastern Europe, according to statements received by Bloomberg. The hackers, which he calls "Group E", are considered professional cybercrimminals that typically sell leaked information to spammers, and are unlikely to be working for any specific nation.

Komarov, who is a chief intelligence officer at InfoArmo, said that three unknown users had paid $300,000 for full copies of the leaked database, two of which are known spammers. The seller gave one buyer a list of 10 details belonging to US government officials to verify authenticity, which led Komarov to speculate the buyer was part of a foreign intelligence agency.

The researcher suspected that Yahoo had been hit by a second attack when news of a 2014 hack in September revealed a leaked database that differed from the one he had discovered. InfoArmo was able to intercept the database as it was being sold, and alerted Yahoo of the discovery in October, which has since been confirmed this week.

"The difference of [the] Yahoo hack [to] any other hack is in that it may really destroy your privacy, and potentially have already destroyed it several years ago without your knowledge," said Komarov speaking to Bloomberg.

"The Yahoo hack makes cyber espionage extremely efficient," added Komarov. "Personal information and contacts, email messages, objects of interest, calendars and travel plans are key elements for intelligence-gathering in the right hands."

Although Yahoo blamed the first hack on a third-party state-sponsored hacker, the company has been silent on who may have carried out the second, much larger attack.

15/12/2016:US senator calls for probe of Yahoo security following hack

A senior Democratic senator has said he would launch an investigation into Yahoo's security practices after a second massive data breach was reported on Thursday affecting over 1 billion user accounts.

The hack, which is now the largest on record, was reportedly carried out in 2013 when an unauthorised third party accessed data containing over 1 billion user details, potentially including names, telephone numbers and hashed passwords.

Following Thursday's news of another data breach, Senator Mark Warner of Virginia announced he would be seeking to probe Yahoo security protocols to establish how such a significant amount of user data could have been stolen.

"This most recent revelation warrants a separate follow-up and I plan to press the company on why its cyber defences have been so weak as to have compromised over a billion users," said Warner, in a statement to Reuters.

Warner, who is set to become the leading Democrat on the Senate Intelligence Committee in 2017, said he had also made repeated attempts to contact Yahoo for a briefing covering the first reported hack in 2014, which affected 500 million accounts, but failed to get a reply.

"If a breach occurs, consumers should not be first learning of it three years later," added Warner. "Prompt notification enables users to potentially limit the harm of a breach of this kind, particularly when it may have exposed authentication information such as security question answers they may have used on other sites."

Following the hack in 2014, the senator approached US security services to investigate Yahoo's actions and whether it sufficiently met obligations to inform the public of the breach.

Yahoo has claimed that the stolen information did not include passwords in clear text, or any financial details, however users have been urged to take steps to secure their accounts, and replace security questions and answers.

15/12/2016:Yahoo hack: More than one billion Yahoo accounts hacked

Yahoo has confirmed that more than a billion user accounts have been hacked in a security breach back in 2013. The breach could scupper its acquisition by Verizon.

The internet firm said in a statement that it believed an unauthorised third party stole data associatedwith more than one billion user accounts in August 2013. It said it has not been able to identify the intrusion associated with this theft.

It added that this was "distinct from the incident the company disclosed on September 22, 2016", when it revealed 500 million email addresses had been hacked back in 2014.

For potentially affected accounts, the stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers.

Yahoo said that its investigations indicated that the stolen information did not include passwords in clear text, payment card data, or bank account information. "Payment card data and bank account information are not stored in the system the company believes was affected," the firm said.

It has notified affected users and taken steps to secure their accounts. It has also invalidated unencrypted security questions and answers so that they cannot be used to access an account.

In a separate issue, Yahoo said that outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password.

"Based on the ongoing investigation, the company believes an unauthorized third party accessed the company's proprietary code to learn how to forge cookies. The outside forensic experts have identified user accounts for which they believe forged cookies were taken or used," said the firm.

It said that it had connected some of this activity to the same state-sponsored actor believed to be responsible for the data theft the company disclosed on September this year.

The latest breach could threaten to derail its impending sale to Verizon, because the acquisition would mean that Verizon may become liable for these breaches. This could result in Verizon offering less for the purchase of the troubled web giant.

Ilia Kolochenko, CEO of web security firm High-Tech Bridge, said:"Such disclosure, taking into consideration the unclear and even suspicious disclosure timeline - just before the buyout, may provide a valid reason for Yahoo's shareholders to sue Yahoo's top management if the deal fails or brings less money than expected."

Paul German, CEO at encryption firm Certes, told IT Pro in a written statementthat with Yahoo suffering two of the largest hacks in history, its attitude to cyber security is seriously into question.

"Yahoo is relying on an outdated cybersecurity model which takes a, protect', detect', react' approach which simply does not work. The problem lies in the fact that once inside a network, there is a significant delay before a hacker is detected, leaving them free to move uninhibited, accessing vast quantities of sensitive data and wreaking havoc," he said.

Brian Laing, vice president at malware detection firm Lastline, added that firms too often fail to account for the magnitude of potential losses when resourcing preventative measures.

"Perhaps a Yahoo - Verizon deal adjustment may stand as a sober reminder how important it is to get a state-of-art cyber defence strategy in place," he said.

10/11/2016: Yahoo says its employees knew about the hack in 2014

In a securities filing on Wednesday, Yahoo said some of its employees knew that a "state-sponsored actor" had broken into its network two years ago.

This was the attack that led to theft of data such as names, dates of birth and passwords associated with more than 500 accounts. It's considered to be one of the largest-ever data breaches affecting a private company.

The company did not state whether, at the time, this attack was disclosed to senior management.

Yahoo first revealed a data breach had taken place on 22 September this year. It said the hack was discovered while investigating a hacker's claim of possessing some Yahoo user data.

The Yahoo filing also said that the company was investigating "certain evidence and activity that indicates an intruder, believed to be the same state-sponsored actor responsible for the security incident, created cookies that could have enabled such intruder to bypass the need for a password to access certain users' accounts or account information."

The company plans to sell its internet operations to Verizon for $4.8 billion. Pinning down whether employees knew or when they found out about the attack has therefore become a priority for the deal to be carried through.

The deal with Verizon had been decided a couple of months before the data breach was made public, and the company could be wanting to learn more about how it happened and was dealt with.

31/10/2016:EU data watchdogs demand answers about Yahoo hack

Europe's data watchdogs have expressed concerns over Yahoo's alleged systematic email surveillance andthe leak of 500 million user credentials.

In aletterdelivered to the US email provider last Thursday, the Article 29 Data Protection Working Party (WP29) described the 2014 data breach, which only emerged in September, as "deeply concerning", and said it is duty-bound to protect "the significant number of EU data subjects" who may have been affected.

"It is of the utmost importance that Yahoo devote significant resources to understand, communicate and address all aspects of this unprecedented data breach and notify the adverse effects to the data subjects using the services that your company provides," said the letter from the WP29, which comprises all 29 EU member states' data protection regulators.

"This must be carried out in a quick, comprehensive and easily understood manner, so that Yahoo users across Europe will understand any action they need to take as a result of the breach," added the WP29.

It urged Yahoo to cooperate fully with any investigations and queries, and deliver specific information which is "of interest" to the authority. This includes the content of the data, consequences of the 2014 breach and the number of people affected in each European country.

The letter, signed by chairwoman Isabelle Falque-Pierrotin, also addressed the "concerning" mass surveillance Yahoo allegedly conducted, with the firm accused of using a systematic search of all incoming user emails at the request of the US government.

"It will be important to understand the legal basis and justification for any such surveillance activity," said the letter, "...including an explanation of how this is compatible with EU law and the protection of EU citizens."

"We are aware of the letter from the Article 29 Data Protection Working Party and will work to respond as appropriate," said a Yahoo spokesperson, in an email to IT Pro.

The EU privacy group also delivered a letter toWhatsApp on Friday, expressing "serious concerns" over the way the messaging app handles its users' private data. The letter urged WhatsApp to halt all plans to share data with its parent company Facebook, until "appropriate legal protections can be assured."

19/10/2016:Yahoo profits bloom despite hack

Yahoo's quarterly profits were better than analysts had anticipated, despite the company's recently revealed hack of 500 million people's account details.

The data breached during the hack included customers' names, email addresses, telephone numbers, personal details and passwords, according to Yahoo CISO Bob Lord.

Verizon, who was looking to buy Yahoo for $4.83, displayed concerns last week, saying that the hack could have a material impact on the deal.

However, Tuesday's stock market results showed that the hack had no major effect on the number of Yahoo customers. Yahoo said results actually showed a growth in page views and email account usage.

Contrary to expectations, Yahoo's quarterly profits more than doubled, reaching $163 million. Yahoo CEO Marissa Mayer said: "We launched several new products and showed solid financial performance across the board."

As Yahoo continues to lose share within the digital advertising market, these positive financial results could be due to a good cost management strategy.

Analysts are still unsure as to whether Verizon's acquisition of Yahoo will still go ahead. Although most don't expect the deal to be entirely cancelled due to the hack, the price and contract terms of it could be renegotiated.

Mayer said: "In addition to our continued efforts to strengthen our business, we are busy preparing for integration with Verizon. To that end, we take deep responsibility in protecting our users and the security of their information. We're working hard to retain their trust and are heartened by their continued loyalty as seen in our user engagement trends."

11/10/2016: Yahoo disables email forwarding

Users of Yahoo mail are unable to forward emails to external accounts, as the feature has been "temporarily disabled".

According to abrief poston its support forums, Yahoo has blocked users from using the 'automatic forwarding' function as they work to develop the feature further.

Users would normally be able to create copies of their incoming messages using automatic forwarding, which would be sent to other accounts such as Hotmail or Gmail. However, users began complaining at the beginning of the month that this feature had been blocked, according to theAssociated Press.

Yahoo said in the post: "This feature is under development. While we work to improve it, we've temporarily disabled the ability to turn on Mail Forwarding for new forwarding addresses."

Yahoo user Brian McIntosh said forwarding has been "a basic concept for 15 years for just about every email provider out there. All of a sudden it's under development, and only at Yahoo", speaking to theAssociated Press.

"That all this has ceased to function when they have been getting a lot of press seems extremely dubious to me," added McIntosh.

In September Yahoo revealed a record-breaking hack of personal information, affecting at least 500 million customers in 2014.

More recently the company was found to have secretly built custom software to scan emails, allowing the US government to conduct surveillance on its users' emails.

IT Proapproached Yahoo to ask why it has disabled this function and if it was related to the data breach, but we have yet to receive a reply.

What is certainly true is that this move makes it more difficult to users to move to other email accounts, which is likely happening on a mass scale right now.

27/09/2016:Yahoo 'using unsecured certificates'

Yahoo hasn't taken the necessary steps to patch security holes that could leave customers open to further hacks, it has been claimed.

Security firm Venafi Labs carried out research on Yahoo's use of cryptographic systems and security certificates and found some troubling results.

According to the firm, which used a combination of its own data and data from global certificate intelligence database TrustNet, 27% of certificates on external Yahoo sites haven't been reissued since the beginning of last year.

This is despite the reissuing of certificates being a common and critical practice to mitigate a breach, to ensure that hackers no longer have access to encrypted communications.

Venafi has also claimed that, based on its research, Yahoo may not have the ability to find and replace digital certificates quickly, as only 2.5% of those in use have been issued within the past three months.

The company has also accused Yahoo of using outdated and unsecure encryption methods, in particular, MD5 and SHA-1. MD5 is, for example, vulnerable to the Flame family of malware. SHA-1 certificates, meanwhile, will no longer be accepted by most major browser vendors as of January 2017.

Hari Nair, director of product management and cryptographic researcher for Venafi, said: "Any one of these cryptographic issues would leave an organization extremely vulnerable to attacks on encrypted communication and authentication.Collectively, they pose serious questions about whether Yahoo has the visibility and technology necessary to protect encrypted communications and ensure its customer's privacy.

"Our research has led us to believe that there is usually a high degree of correlation between weak cryptographic controls and overall cybersecurity posture."

A source familiar with the matter told IT Pro: "The vast majority of hashed passwords stolen by what we believe was a state-sponsored actor are bcrypt protected, and only a small percentage of passwords are protected with MD5.

"As we said, we're notifying potentially affected users and we've taken steps to secure their accounts, including recommending that users who haven't changed their passwords since 2014 do so."

23/09/2016: Yahoo hack: 500 million people's account details stolen 'by nation state hacker'

Yahoo has confirmed that at least 500 million people's account details were stolen by a state-sponsored hacker.

The data breach included people's names, email addresses, telephone numbers, dates of birth, hashed passwords and even security questions and answers, Yahoo CISO Bob Lord explained.

The search giant, which said the hack took place in late 2014, does not believe the stolen data included any credit card details, unprotected passwords or bank account information.

"Based on the ongoing investigation, Yahoo believes that information associated with at least 500 million user accounts was stolen and the investigation has found no evidence that the state-sponsored actor is currently in Yahoo's network," Lord said in a post on Tumblr. "Yahoo is working closely with law enforcement on this matter."

News of the hack first emerged yesterday from Recode, but it is not yet clear whether the stolen account details is related to a data dump of 200 million Yahoo accounts made available on the dark web last month.

The hacker who collated them and put them up for sale online, going by the moniker Peace, said those details were from "2012, most likely".

Yahoo is now in the process of notifying customers who may be affected, and asking them to change their passwords, or use different methods of confirming their identity.

It has invalidated any unencrypted security Q&As and urged customers to use its Yahoo Account Key, a two-factor sign-in method it first rolled out in March this year, that sends a push notification to a user's smartphone when they need to log into their email.

The huge batch of exposed passwords beats Dropbox's 61 million credentials that were leaked online in August after a hack in 2012, leading to Dropbox also urging users to change their passwords.

Lord added: "An increasingly connected world has come with increasingly sophisticated threats. Industry, government and users are constantly in the crosshairs of adversaries. Through strategic proactive detection initiatives and active response to unauthorized access of accounts, Yahoo will continue to strive to stay ahead of these ever-evolving online threats and to keep our users and our platforms secure."

22/09/2016: Yahoo expected to confirm massive data breach

Yahoo has been hit by a massive data breach, according to leaked reports, which the company is expected to confirm later today.

Sources told Recode's Kara Swisher - long a top source for Yahoo news - that the hack affects several hundred million users, calling it "widespread and serious".

The hack comes at an awkward time for Yahoo, which is selling much of its business - including customer data - to Verizon as part of a $4.8 billion deal.

Details are scarce as Yahoo has yet to confirm the attack, but it appears the security breach is related to the apparent leak of 200 million accounts earlier this year by a hacker known as "Peace". Yahoo at the time didn't confirm if that hack was legitimate, merely stating it was "aware" of the incident.

IT Pro asked Yahoo for confirmation of the attack, but has yet to hear back. However, users have started to see messages to change their passwords.

Nikki Parker, vice president at security firmCovata, criticised Yahoo's security measures. "In this case, last month, the hacker claimed that the data was hashed with a MD5 algorithm, coding that simply isn't robust enough to secure data," Parker said in a statement. "You'd hope that Yahoo would've since thought about adopting more advanced encryption technology that secures data in individual pieces rather than in large sets, as well as empowering it to rigorously control access."

Parker claimed that Yahoo's slow response was "surprising", adding: "It should have encouraged customers to change their passwords and now, potentially, more than 200 million people are at risk and have been for some time."

If the hack is indeed confirmed, CensorNet's CEO Ed Macnair said the usual advice applies. "Change your username and passwords across sites and with business accounts," he said in a statement.

"Not only is personal data at risk here, but people often use such logins at work. That is always a huge issue for companies. Everyone should stay vigilant to suspicious activity and, it would be advisable to get some new passwords ready just in case."

Yahoo's former CEO, Marissa Mayer, and both the current and former CEOs of Equifax have been summoned to appear before the US Senate to testify on two massive data breaches that are thought to have affected over three billion people.

Mayer will appear before the Senate on 8 November alongside former Equifax CEO Richard Smith, who retired from the company in September following news of a massive data breach, and the company's interim CEO Paulino do Rego Barros Jr.

Frederick Hill, a US Senate Commerce Committee spokesperson, confirmed to Reuters that the three executives would be asked to testify, as authorities continue to assess whether the breaches could have been prevented, and whether there are likely to be any further revelations.

Yahoo revealed in October that all three billion customer accounts had been affected by a breach of its systems in 2013, tripling its original estimate from December last year. The breach, alongside a second attack in 2014 thought to have hit 500 million accounts, is considered the worst instance of data theft in industry history.

News of the Yahoo's two data breaches wiped $350 million off the price of its assets during the takeover deal by Verizon before the latest revelation, which occurred after Verizon's purchase closed. Verizon paid $4.48 billion for Yahoo when the deal closed in June, although departing CEO Mayer is thought to have received over $200 million in severance pay and the sale of stocks and shares.

Equifax disclosed in September that it had also suffered a data breach, affecting 145.5 million of its US customers. However, subsequent updates have revealed that 15 million UK customers were also affected by the breach, including 700,000 accounts holding credit card details.

The UK's Financial Conduct Authority (FCA) has since launched an investigation into the data breach, although the authority's chief executive Andrew Bailey said that Equifax had failed to notify the FCA, and he only became aware of the details through morning news reports.

Part of that investigation will look into Equifax's handling of the data breach, the full scope of which has been revised a number of times since it was first revealed. It also faced criticism over its customer help website, which was forced offline following concerns it had been infected with malware.

Equifax's use of the website 'equifaxsecurity2017.com' as its main support portal drew the ire of customers who thought it looked like a phishing website.

A letter addressed to Treasury Committee Chair Nicky Morgan MP also revealed that Equifax only started to notify affected customers via the post on 13 October, although a phased rollout means it won't be until 24 November that all affected customers are notified.

Former CEO Rick Smith has already appeared before a US house committee to explain the breach, and it's likely the company will be asked to present similar explanations before a committee in the UK, although there are no specific demands in place.

A US judge has stated that Yahoo must face litigation from users who had their personal information revealed in three data breaches.

Judge Lucy Koh, based in San Jose, California, made the decision, reported by Reuters, which will be a setback for Verizon as it now owns Yahoo under an umbrella called Oath.

The data breaches took place between 2013 and 2016 but Yahoo is being criticised as it took time to notifiy its customers about them.

Judge Lucy Koh said victims could pursue some breach of contract and unfair competition claims.

"All plaintiffs have alleged a risk of future identity theft, in addition to loss of value of their personal identification information," she wrote.

Koh highlighted that some of the victims could have changed their passwords or canceled their accounts to protect themselves if Yahoo had not taken so long in letting them know about the breaches.

John Yanchunis, a lawyer for the plaintiffs, told Reuters: "We believe it to be a significant victory for consumers, and will address the deficiencies the court pointed out."

"It's the biggest data breach in the history of the world," he added.

IT Pro has contacted Oath and Verizon for comment, the former declined to comment on litigation.

Yahoo had multiple data breaches between 2013 and 2016 which led to customers suing the company because their personal details were stolen. In a 2014 breach, names, email addresses, phone numbers and encrypted passwords of Yahoo users had been stolen.

Due to the data breaches, Verizon was able to knock $350 million off its acquisition of Yahoo. It also stipulated that Yahoo is responsible for 50% of any cash liabilities incurred as a result of investigations into the breach.

Verizon closed its acquisition of Yahoo yesterday, merging the brands which include not only Yahoo, but also Tumblr, AOL and others into its media behemoth, Oath.

Yahoo CEO Marissa Mayer will leave as a result of the acquisition, though she said she was "brimming with nostalgia, gratitude, and optimism".

The $4.48 billion transaction will see Mayer receive a $186 million payout, according to previous Yahoo securities filings.

In a Tumblr post, she said: "Looking back on my time at Yahoo, we have confronted seemingly insurmountable business challenges, along with many surprise twists and turns. I've seen our teams navigate these hurdles and mountains in ways that have not only made Yahoo a better company, but also made all of us far stronger.

"During these past five years, we've built products that delight our users, focused on our clients' businesses, driven substantial value for our shareholders, and endeavored to make Yahoo the absolute best place to work."

The closing of Verizon's $4.48 billion takeover brings an end to a sometimes troubled transaction that saw the telecoms firm reduce its initial offer by $350 million in the wake of two historic hacks that affected more than one billion Yahoo users.

Marni Walden, Verizon president of media and telematics, said the acquisition is a "critical step" in growing Verizon's Oath division to a worldwide scale.

"The combined set of assets across Verizon and Oath, from VR to AI, 5G to IoT, from content partnerships to originals, will create exciting new ways to captivate audiences across the globe," she added.

Tim Armstrong, former CEO of Oath-subsumed AOL, is leading the Oath division of more than 50 media brands now including Yahoo Finance, Yahoo Sport, Tumblr, HuffPost and more.

He said: "We're building the future of brands using powerful technology, trusted content and differentiated data. We have dominating consumer brands in news, sports, finance, tech, and entertainment and lifestyle coupled with our market leading advertising technology platforms."

Under Armstrong, Oath will attempt to offer more innovative ways of advertising, rolling out tools like ONE by AOL and programmatic ad tool BrightRoll to span mobile, video, search, native and more.

Yahoo has said its investors have agreed to the proposed sale of its operating business to Verizon for $4.48 billion (3.5bn), following the results of a preliminary stockholder meeting on Thursday.

Yahoo is to form part of Verizon's recently formed Oath media division, joining AOL, the Huffington Post, Techcrunch, Tumblr and Brightroll. The agreement means that a deal is likely to close by 13 June, according to a company statement.

As previously reported, Yahoo will undergo a name change, registering as an investment company called 'Altaba Inc'. Under the new name, the company's primary assets will be tied up in a stake in Alibaba Group, while retaining a 35.5% stake in Yahoo Japan. The company also said that has extended the date of an offer to buy back up to $3 billion in shares from 13 June to 16 June.

Following the news of two massive cyber attacks in 2013 and 2014, affecting over 1 billion customer accounts, the takeover offer was revised down by $350 million.

Yahoo CEO Marissa Mayer will also be stepping down from her position and will not be joining the newly formed Altaba.

The news coincides with reports that Verizon is preparing to lay off 2,100 employees following the acquisition, which accounts for 15% of Yahoo's 8,600 workforce.

Employees won't be leaving entirely empty handed, as their accumulated stock shares rose on Thursday by 10%. The surge also means that CEO Marissa Mayer, who won't be joining the newly formed Altaba, will depart with $264 million, up from $239 million last week.

Substantial severance packages are also being forked out to other Yahoo executives. Chief revenue officer Lisa Utzschneider will leave with around $22 million, while Ken Goldman, the chief financial officer, will receive a reported $12 million.

Yahoo has announced in its first quarterly 2017 results that it expects its acquisition by Verizon to close in June.

Marissa Mayer, the CEO of Yahoo, underlined how $1.3 billion was delivered in GAAP revenue. She added: "As we enter our final quarter as an independent company, we are committed to finishing strong and planning for the best possible integration with Verizon. With the transaction anticipated to complete in June, I've never been more proud of the improvements we've made to the business and the value we've delivered to our shareholders."

Yahoo will form part of Verizon's Oath media division, which will also incorporate AOL, the Huffington Post, Techcrunch, Tumblr and Brightroll. The name of the brand was released in a tweet by AOL CEO Tim Armstrong on 3 April 2017 and on the official website it says: "Someone snitched. So now you know our name but just wait - the fun really begins summer 2017".

Verizon is expected to pay $4.83 billion (3.89 billion) for Yahoo, although the price of the deal was lowered by $350 million after two cyber attacks came to light where 1 billion customer accounts were compromised in 2013 and another 500 million in 2014.

Yahoo CEO Marissa Mayer will not be continuing with the new company, which will instead be led by Armstrong. Mayer will not receive her full payout, either, following the hacks but should still receive $23 million $9 million less than she would have been awarded had they not occurred.

The Kremlin has denied allegations its FSB intelligence agency was involved in the Yahoo data breach, despite two of its agents being indicted by the US Department of Justice on suspicion of hacking into the search giant's user database.

"We have said repeatedly that there can be no discussion of any official involvement of any Russian office, including the FSB, being involved in any unlawful cyber activities,"spokesman Dmitry Peskov said in a statement.

The spokesman for the Russian government told reporters at a press conference that the allegations were unfounded and in fact, it had not been approached by the US government, but was obtaining its information about the allegations from the media.

"We learned about this situation from the media, as far as we know, we did not receive any information from official channels, so unfortunately we do not have the details," Peskov added. "Russia has always expressed interest in cooperation in the field of countering cybercrime and ensuring cybersecurity, we believe that this is one of the priorities in our time."

According to Sky News, it's a well-discussed subject between US authorities and cyber security specialists that Russia employs hackers to help the government "advance its agenda while denying involvement".

16/03/2017: US government reveals how Russian spies allegedly hacked Yahoo

US officials have revealed how Russian spies allegedly carried out a massive attack on Yahoo's systems, enabling the Kremlin to spy on more than 500 million people.

The Department of Justice yesterday indicted two Russian nationals and residents, 33-year old Dmitry Aleksandrovich Dokuchaev and 43-year-old Igor Anatolyevich Sushchin, who worked as officers for Russian intelligence agency the FSB.

Yahoo has praised the news, saying: "The indictment unequivocally shows the attacks on Yahoo were state-sponsored. We are deeply grateful to the FBI for investigating these crimes and the DOJ for bringing charges against those responsible."

"We appreciate the FBI's diligent investigative work and the DOJ's decisive action to bring to justice to those (sic) responsible for the crimes against Yahoo and its users. We're committed to keeping our users and our platforms secure and will continue to engage with law enforcement to combat cybercrime."

"The criminal conduct at issue, carried out and otherwise facilitated by officers from an FSB unit that serves as the FBI's point of contact in Moscow on cybercrime matters, is beyond the pale," said acting assistant attorney General McCord. "State actors may be using common criminals to access the data they want, but the indictment shows that our companies do not have to stand alone against this threat."

The indictment also named 29-year old Latvian-born Russian national and resident Alexsey Alexseyvich Belan, as well as a fourth man, 22-year old Canadian and Kazakh national and Canadian resident Karim Baratov, both of whom are accused of being criminal hackers.

The indictment accuses Sushchin and Dokuchaev of disregarding an Interpol Red Notice for the detention of Belan, who was placed on the FBI's list of most wanted cyber criminals in 2013. Rather than arresting him, the DoJ claims the two FSB agents used him to gain access to Yahoo's systems.

Belan reportedly stole all or part of Yahoo's user database, which acts as a registry of all the information associated with user accounts. This includes names, phone numbers and alternate email addresses, but most importantly it also contained all the data to forge browser cookies.

Using this information, as well as access to Yahoo's internal account management tools, Belan, Dokuchaev and Sushchin were able to identify high-value Yahoo accounts and forge counterfeit cookies for those accounts, which would trick web browsers into thinking that they had already logged in as the victim.

Among the 6,500 Yahoo users the FSB agents targeted with this scheme were targets that were "of predictable interest", including journalists, government officials in both the US and Russia, and the staff of "a prominent Russian cybersecurity company". Also targeted were employees of private sector banking and investment firms in Switzerland, Russia and the US, as well as an American airline and a French transportation company.

The US has accused Sushchin and Dokuchaev not just of directing Belan to hack into Yahoo, but also facilitating his unrelated criminal activities by feeding him "intelligence information that would have helped him avoid detection by US and other law enforcement agencies". Belan allegedly made the most of this, stealing gift card numbers and credit card information from Yahoo accounts and using over 30 million users' contact details to propagate a spam campaign.

Baratov was reportedly instructed by the two FSB agents to access accounts held by high-value targets with other online providers, using data obtained as part of the Yahoo hack to gain entry.

Between them, the four men have been charged with over 47 counts of hacking and espionage-related offences, including conspiracy to commit wire fraud, aggravated identity theft and theft of trade secrets.

"Silicon Valley's computer infrastructure provides the means by which people around the world communicate with each other in their business and personal lives," said US attorney Brian Stretch. "The privacy and security of those communications must be governed by the rule of law, not by the whim of criminal hackers and those who employ them.

"We will not tolerate unauthorised and illegal intrusions into the Silicon Valley computer infrastructure upon which both private citizens and the global economy rely."

15/03/2017 - 15.32:The US Justice Department is set to blame the Yahoo hack on Russian spies and government-hired hackers, according to reports.

Reports have indicated that the US law enforcement is preparing to move on four individuals connected to the cyber-attack, but according to the Washington Post, new information has revealed that the suspects are all tied to the Kremlin.

According to the report, two operatives working for the Russian intelligence agency FSB and two state-sponsored cyber criminals will be charged with economic espionage, wire fraud, trade secret theft and hacking.

The indictments will be the first criminal hacking charges ever brought against Russian government personnel, and also come as part of the US' largest ever hacking case.

The Washington Post has stated that Russia carried out the hack, which affected Yahoo customers' email services as well as apps like Flickr, in order to target dissidents, journalists, US government officials, in addition to monetising the accounts through spam operations.

15/03/2017 - 12.39:US authorities are ready to issue indictments against individuals allegedly involved in the hacking attacks against Yahoo revealed last year, which affected more than 1.5 billion users.

The US Justice Department is targeting four people accused of participating in the massive cyber attacks against the US technology giant, according to an anonymous Bloomberg source.

An arrest of a suspect in Canada will be made as early as Tuesday, although three others are currently in Russia, according to the source.

The individuals are suspected of being involved in the theft of millions of user details through a security breach, including email addresses, dates of birth and hashed passwords, which could be used in more targeted attacks in the future.

Yahoo disclosed news of an attack in September which had been carried out at some point in late 2014, leading to the loss of 500 million user records. Yet this was eclipsed by news in December of a separate hack in 2013, in which involved over one billion user accounts.

News of the two data breaches almost scuppered plans for a takeover deal by Verizon, which has since been marked down by $350 million to $4.48 billion. The hacks also damaged Yahoo CEO Marissa Mayer's departure from the company, who was recently paid $23 million as a parting gift from Verizon, $9 million less than was anticipated before news of the breach.

Yahoo has failed to identify those responsible for the larger 2013 breach, according to a recent filing, but has said it believed a state-sponsored actor was to blame for the attack in 2014.

Yahoo has declined to comment on the news.

Verizon has reduced the amount it's paying to buy Yahoo by $350 million after its massive data breach last year.

The company has also adjusted the terms of the agreement, saying Yahoo is responsible for 50% of any cash liabilities incurred as a result of investigations inot the breach by non-Securities and Exchange Commission government investigations or third-party litigation.

The two companies will also share legal and regulatory liabilities arising from the incident. Verizon said it hasn't been deterred from buying Yahoo, however, despite losing the data of more than a billion people.

"We have always believed this acquisition makes strategic sense," Marni Walden, Verizon executive vice president and president of product innovation and new businesses, said. "We look forward to moving ahead expeditiously so that we can quickly welcome Yahoo's tremendous talent and assets into our expanding portfolio in the digital advertising space."

She added that the amended terms of the agreement provide a "fair and favorable outcome for shareholders", with protections in place for both Verizon and Yahoo. Walden believes it will ensure the two companies can be as profitable as possible in the future.

"We continue to be very excited to join forces with Verizon and AOL," Marissa Mayer, CEO of Yahoo, added. "This transaction will accelerate Yahoo's operating business especially on mobile, while effectively separating our Asian asset equity stakes.

"It is an important step to unlock shareholder value for Yahoo, and we can now move forward with confidence and certainty. We have a terrific, loyal, experienced team at Yahoo. I'm incredibly proud of our team's strong product and financial execution in 2016, setting the stage for a successful integration."

Yahoo's alleged scanning of user emails on behalf of the US government could undermine the newly agreed Privacy Shield data regulations if they turn out to be true.

Ireland's data protection commissioner, which is the lead European regulator on privacy issues for Yahoo, is making inquiries as to whether any European citizens may have been affected.

"Any form of mass surveillance infringing on the fundamental privacy rights of EU citizens would be viewed as a matter of considerable concern," the regulator said in a statement.

According to bothReutersandThe Times(subscription required), European politicians have called on the European Commission to investigate the matter, with lawyers saying a legal challenge to the Privacy Shield agreement, which was settled on earlier this year, is now more likely.

In the US, the legality of Yahoo's reported actions has also been called into question.

Patrick Toomey, a staff attorney with the American Civil Liberties Union (ACLU), toldIT Pro: "Based on [Reuters's initial report] the order issued to Yahoo appears to be unprecedented and unconstitutional. The government appears to have compelled Yahoo to conduct precisely the type of general, suspicionless search that the Fourth Amendment was intended to prohibit."

In this country, however, it has been claimed this behaviour may not be illegal even if UK citizens were among the subjects of the alleged spying.

Privacy International legal officer Camilla Graham Wood toldIT Pro: "The information on the scanning of emails by Yahoo remains sparse. It is important to note that similar powers exist in the United Kingdom, in the form of the Investigatory Powers Bill. There has been little public debate about how intrusive such powers are. The fault lies with the Government in failing to clearly inform the public about the broad spectrum of powers that will be authorised by the Investigatory Powers Bill.

"We do not know if the UK Government has already requested that companies scan their customers' emails on a bulk scale, but we do know that this will be possible under the Investigatory Powers Bill, if we look at powers such as Technical Capability Notices."

IT Pro contacted two telcos known to have used Yahoo's email services, either in the past or currently Sky and BT to find out if their customers may be among those who allegedly had their data scanned.

A BT spokesman said: "Yahoo have stated they are a law abiding company and comply with the laws of the United States." Sky did not respond to IT Pro's request for comment.

According to The New York Times, Yahoo was forced by a secret court order adapted existing software, which scans for spam and images of child abuse being sent to Yahoo Mail addresses, "to search for messages containing a computer 'signature' tied to the communications of a state-sponsored terrorist organisation", citing "several people familiar with the matter".

"With some modifications, the system stored and made available to the [FBI] a copy of any messages it found that contained the digital signature," theNYT reported.

"The order was unusual because it involved the systematic scanning of all Yahoo users' emails rather than individual accounts," the newspaper added.

Several other tech companies, including Google, Facebook, Microsoft and Twitter said they had never received this kind of request and that if they had, or do in the future, they would fight the order in court.

05/10/2016: Yahoo 'snooped on users' emails and passed data to the NSA'

Yahoo has secretly been scanning its customers' emails and sending information contained in them to the NSA, according to aReuters report.

Three former Yahoo employees and a fourth person "appraised of the events" allegedly toldReuters the beleaguered company last year "secretly created a software programme to search all [Yahoo Mail] customers' incoming emails for specific information provided by the US intelligence officials".

The details of the case are a little hazy beyond this information Reuters was unable to determine what keywords or information were being scanned for, what information (if any) was handed over, or whether any other email providers were asked to comply with the same order.

However, the news agency's sources did indicate that the decision to comply with the request was one of the reasons the company's then-CIO, Alex Stamos, resigned in June 2015.

In a statement to Reuters, a spokesperson said: "Yahoo is a law abiding company, and complies with the laws of the United States."

The situation has riled both privacy campaigners and the tech community at large.

Jim Killick, executive director of the Open Rights Group, toldIT Pro: "This could be very damaging for Yahoo and will no doubt affect the trust its customers have in their services. Surveillance should be carried out through a transparent legal framework and only in response to warrants.

"While there may be a need for companies to scan incoming emails for malware and spam ... they should not indiscriminately spy on customers who are not suspected of any crime. Yet again we need more transparency about how companies are working with law enforcement and security agencies."

Rafael Laguna, CEO of Open-Xchange said: "The integrity of Yahoo as an email provider is in tatters. As a user, if you're not having your details leaked online you can be sure the US government is rifling through your emails and attachments. This utter disregard for the consent of law abiding citizens is shocking but it is something the NSA and GCHQ increasingly believe they can do with impunity."

Only last month Yahoo confirmed a hack in late 2014 obtained 500 million people's usernames and passwords, with the search giant blaming a "nation state actor".

A man has decided to sue Yahoo after it was revealed the personal details of 500 million people were stolen in a data breach.

The New York resident has decided to take the matter into his own hands, suing the internet giant for gross negligence on behalf of everyone affected.

The case doesn't specify how much the man is claiming Yahoo should pay the individuals, but his case says the company didn't put the security measures in place to prevent the hack happening.

"Companies will get breached, that's not news and I don't think customers believe any differently. What customers do implicitly expect from companies is that threats and breaches are detected in a timely manner and remedial actions taken," said Javvad Malik, security advocate at security firm AlienVault.

"It is essential for companies to put in place robust threat detection and response controls to be able to react in a timely manner whenever a breach occurs."

Yahoo would not comment on the matter, saying the company doesn't discuss pending litigation.

Last week, it was revealed the names, email addresses, phone numbers, birth dates and encrypted passwords of Yahoo users had been stolen in late 2014.

Yahoo is currently in the process of being purchased by US telecoms company Verizon, although it's unclear whether this data breach will have an impact on the sale.

"We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities," Verizon said in a statement.

Don't panic: if the Yahoo hack was going to be used against you by criminals, they'd likely already have done it.

That advice from security experts and analysts may be cold comfort, but businesses need not spend the weekend worrying about the fallout from the leak of 500 million credentials - though there are some steps they should take.

The hack happened in 2014, Yahoo confirmed yesterday, and is likely a state-sponsored attack rather than straight-up cyber criminals, targeting names, email addresses, phone numbers, dates of birth, security answers, and hashed passwords.

IHS analyst Daniel Knapp told IT Prothat though the attack is serious, the timings involved mean the worst of the damage is already done. "The breach was revealed yesterday but it already happened in 2014," he said. "If that's the case, that [any use of the data] will long have happened."

"If companies have not experienced something significant out of this breach so far, they likely will not now," he said. "However, it is recommendable for businesses to go back and investigate whether IT and security problems they had in the past might stem from the breach If you had had any problems, it might be wise, in light of this data breach, to reevaluate those problems."

The standard advice after such hacks is always to refresh your password, and while that's not a bad start, hopefully you've already done so in the intervening two years. "Any Yahoo customers would be prudent to change their passwords - although, given the fact that the breach occurred two years ago, it is a bit like closing the stable door after the horse has not only bolted but long since died of old age," noted Alex Mathews, EMEA technical manager at security firm Positive Technologies.

Confusion remains over whether this attack was related to the summer dump of 200,000 account details. Yahoo said that this attack was by a state-sponsored hacker, suggesting this incident may not be connected to the other, claimed by a cybercriminal known as Peace. If it was more of the same from Peace, that's further reason to breathe a little easier (though Peace may simply be a collater of stolen data, rather than the hacker responsible).

"That data was made available on the darknet for $2,600 dollars which isn't very much and signals the low value of the data set," Knapp said. "The price point on the open market is an indication of what you can do with the data set." And that's good news, as it suggests the data isn't seen as very useful to criminals, but again it's not clear if the two attacks are connected.

Either way, despite the age of the attack, businesses and their IT departments still have a few points to add to their to-do lists in the wake of Yahoo's admission."Businesses have to be careful and concerned, and whenever you entrust your smaller business to a large platform, and don't manage your IT and email yourself, that is a risk you have to deal with," Knapp said.

Threats to your business

Yahoo may have slipped from relevancy in recent years, but you shouldn't assume your staff don't have an account. Skyhigh Networks' stats from its 23 million enterprise end users revealed eight out of ten companies had users signed up to Flickr and Tumblr, both owned by Yahoo, while seven out of ten have users still on Yahoo Mail.

And that means the hack is problematic if users shared passwords or other login credentials across sites - including to access business accounts. And from what we know about users, odds are some have done just that, and personal security questions offer an additional risk.

"Passwords can be changed but factual answers to security questions (such as mother's maiden name) can't be," explained Nicola Fulford, head of data protection at law firm Kemp Little. "Knowledge of security answers could give hackers full access to email and other accounts, which contain details of a whole host of sensitive information about finances, health, family and career."

She added: "This information would enable anyone with access to build a detailed picture of someone's life and enable ID theft."

Such a massive leak of data can also make it easier for criminals to target phishing attacks at company staff. "The Yahoo security breach has leaked enough details to leave users open to sophisticated phishing attacks," said Wieland Alge, vice president for EMEA at Barracuda Networks. "The danger with a data breach of this scale is that at least some users will believe phishing emails are genuine, thereby opening the door to attackers."

With all that in mind, businesses and IT departments would be wise to ask users to change passwords or other login details that may have also been used on Yahoo sites, and to remind staff about phishing attacks, warning them not to open unexpected attachments and to be careful when following links in emails - particularly if they purport to come from Yahoo, which will (hopefully) ask users to head to the site to login rather than offer a direct link.

If you've been considering rolling out two-factor authentication at your business, or any other extra layer of protection above and beyond passwords, now might be a good time to ask for budget. "Smart organisations are already moving to stronger methods of user authentication, including adaptive access control techniques and multi-factor authentication as a way of safeguarding credentials," said Jeff Kukowski, COO SecureAuth.

"It is imperative that more organisations take this lead and look to implement adaptive access in a way that, in addition to the credentials, performs risk-analysis as part of the authentication process. This helps render stolen credentials completely worthless across the breached site."

For Yahoo users themselves, the company offers its own extra authentication tool, called Yahoo Account Key that removes the need for a password at all.

Should it have been reported sooner?

It's unclear exactly when Yahoo became aware of the hack, though reports suggest it may have been a month ago. Kemp Little's Fulford pointed out that under new GDPR laws, such breaches will have to be "reported without undue delay and at least within 72 hours of becoming aware", under threat of a fine of as much as 4% of global turnover.

Existing UK laws mean data watchdog the Information Commissioner's Office may not be best pleased with the late notification. "The current ICO criteria for expecting a data breach to be reported to them considers the sensitivity of the data and the volume of data - the Yahoo breach ticks both boxes," she added.

Information Commissioner Elizabeth Denham said in a statement that the ICO is looking into the incident. "The US authorities will be looking to track down the hackers, but it is our job to ask serious questions of Yahoo on behalf of British citizens and I am doing that today," she said. "We don't yet know all the details of how this hack happened, but there is a sobering and important message here for companies that acquire and handle personal data. People's personal information must be securely protected under lock and key and that key must be impossible for hackers to find."

What about Verizon?

The hack comes as Verizon is closing its deal to buy Yahoo's core businesses for $4.8 billion, raising questions of whether the hack's admission will affect the acquisition.

"We don't expect this to affect this Verizon deal," Knapp said, suggesting Verizon may have known about it when it made the acquisition.

But the Financial Times cited SunTrust analysts as saying between three million and 25 million of Yahoo's billion users could ditch the site over the hack, saying that suggests Verizon should push for a "discount" of $150 million on the deal.

If Verizon does follow through on the deal as expected, Knapp predicted it will have to work hard to keep the "stigma" from affecting its own business. "The stigma that remains through this deal, Verizon needs to act very hard to try to distance itself from the deal to prevent any association with the Verizon brand," he said. "We would expect Verizon to become more proactive in the security game," he added, rolling out new measures, making public statements, and perhaps even buying a security company to "highlight that it's actually doing something".

That said, he added: "We expect them to be public tokens, and not measures that really change how things go at Verizon."

Either way, the situation is a good test case for how a breach can affect a company's fortunes. "This will be an acid test for valuing the impact of an incident like this at a time when risk experts, lawyers, accountants and M&A specialists are engaged and scrutinising every detail with their pencil sharpeners out," said John Madeline, CEO at RelianceACSN, in a statement.

As Knapp noted, the backlash may not be significant, as we've become accustomed to such security breaches. "We live in an age of leaks and there's a bit of data-leak fatigue in public minds," he said. "We have to see how the public really reacts to that, and if a data breach of 500m addresses affords a big enough outrage."

Want to know if you've been hacked? Here's how to find out.

Peace, the hacker behind the Myspace and LinkedIn data dumps, has put what they claim are the details of 200 million Yahoo accounts up for sale on the dark web.

The asking price for the logs, which according to published sample include usernames, hashed passwords, dates of birth and in some cases backup email addresses, is three bitcoins, which equates to 1,373 at the time of writing.

Peace was also behind the sale of 117 million LinkedIn and 360 millionMySpace details earlier this year, which appeared on the same dark net site as this current batch. It is unclear, however, whether the person hacked the database themselves or has simply collated details that were already circulating.

In the 'advert' for the haul, Peace says the credentials are from "2012 most likely", indicating they do not know themselves quite what it contains in terms of age. This could mean a number of the accounts are defunct.

In a statement provided to IT Pro, Yahoo neither confirmed nor denied the validity of the alleged stolen credentials, saying: "We are aware of a claim. We are committed to protecting the security of our users' information and we take any such claim very seriously. Our security team is working to determine the facts. Yahoo works hard to keep our users safe, and we always encourage our users to create strong passwords, or give up passwords altogether by using Yahoo Account Key, and use different passwords for different platforms."

This is the second time what is claimed to be stolen Yahoo credentials have gone on sale on the dark net this year. In May, the details of tens-of-millions of Yahoo, Gmail and Hotmail accounts were discovered by Hold Security on a Russian dark net site.

The accounts "were put on sale for 50 roubles - or just over 50p", according to Express, the online arm of the Daily Express and Sunday Express. The website did not make it clear whether this referred to 50 roubles for each account, or 50 roubles for the entire haul.

In July, Verizon announced it is to acquire Yahoo's advertising and search business for $5 billion. However, the deal does not include its email service. Yahoo intends to kill off passwords, replacing them with a new account login process that sends users a push notification to their smartphone whenever they want to log into their accounts.

This article was originally published on 2 August 2016 at 11.00am and has since been updated to include comments from Yahoo.

Verizon is set to pay around $5 billion (3.8 billion) for Yahoo's ailing search and advertising businesses, according to reports.

The unconfirmed bid comes after the once-great internet search giant admitted a $440 million loss in financial results released last week, and the firm would give the US telco a vast swathe of customer data.

Verizon, which recently bought AOL, a contemporary of Yahoo's in the early 2000s, might merge the two acquisitions into one behemoth that could potentially challenge firms like Google, Facebook and Twitter.

"Verizon is hoping that combining Yahoo's content with AOL's ad technology platform and Verizon's own insights into user data can make the advertising inventory much more valuable," Craig Moffett, an analyst at MoffettNathanson, told Bloomberg.

But Forrester analyst Shar VanBoskirk said Yahoo's huge amount of customer data would boost Verizon's advertising play.

In comments provided to IT Pro, she said: "The more access to customer data it has (online through Yahoo and AOL, in home via cable boxes, on mobile via smart devices) the more targeted it can be with advertising and sponsored content or product placements across those same devices.

"This allows Verizon to create better ad products which are competitive against primarily online giants (Google) and creates a better user experience which is competitive against other cable and telecom providers."

Yahoo's failure to succeed

The alleged takeover comes after Yahoo CEO Marissa Mayer abandoned her plans to spin off Yahoo's $32 billion Alibaba stake in December 2015.

Under pressure from investors, she instead decided to spin off Yahoo's core assets - including Yahoo Mail and its search business - a significant shift in strategy from her original intention to return Yahoo to the forefront of technology companies. Forrester's VanBoskirk believes Yahoo's failure was a lack of brand identity.

"For 13 years, Yahoo has failed to exploit as a unified whole what is actually an excellent set of parts," she said. "Since its days as an online portal (circa 1999), Yahoo hasn't been able to clearly define what it is, and what value it provides. This created confusion among users (is Yahoo a search engine? a producer of online video? a place to aggregate my photos? a social media community?)."

She added: "But it also challenged Yahoo's business strategy. When you aren't sure what kind of company you are trying to be: What acquisitions should you make? What efforts do you prioritise? Which leaders do you hire?"

Verizon and Yahoo 'makes sense'

But the proposed tie-up between the telco and the tech giant would be a good one, VanBoskirk said. "If Verizon can manage this acquisition in a customer-first way, the combined entity would go a long way toward creating an experience concierge which could be really valuable to consumers and advertisers," she said.

Yahoo CEO Marissa Mayer will receive a $54.9 million (37.4 million) payout if Yahoo goes under, it has been revealed.

The internet giant's offering has been exposed to the the US Securities and Exchanges Commission, detailing other benefits Mayer will get if Yahoo does not manage to claw back some of its revenues.

The news comes as the company is forced to sell its core business after its mobile-first strategy appears not to have resulted in the returns it expected.

Mayer would receive the money in cash, stock and other benefits if she was removed as chief executive within a year of any sale, the filing detailed.

Other executives at the company would also receive large lump sums if the company is sold and existing staff disposed of. Chief financial officer Ken Goldman, is set to receive more than $16.1 million (10.9 million), and chief revenue officer Lisa Utzschneider would bank $19.9 million (13.56 million).

However, some of the company's shareholders disagree with the way the matter has been handled and do not think executives deserve such large amounts, saying it is their fault the company has failed.

"I don't think this management team has done anything to merit a huge payout," Eric Jackson, managing director of SpringOwl Asset Management told the Associated Press.

Yahoo's revenues have dropped significantly over the last few years as it fails to keep up with competitors such as Google by launching new products and services for both businesses and consumers.

Sales have fallen almost 40 per cent in the last five years and this has had a knock-on effect on executive salaries. For example, Mayer received $6 million (4 million) less last year compared to 2014's compensation.

Yahoo is intensifying its mission to "kill the password" with the release of a new account login process for Yahoo apps.

The web services provider stated its intentions to ditch the password a year ago, when it announced its plans to introduce "on-demand passwords" that would be texted to a user's mobile devices.

Now those plans have been polished and rolled into a new login method, Yahoo Account Key.

The service works by sending Yahoo users a push notification on their mobile phone for them to approve whenever they attempt to sign into their Yahoo account from a new desktop browser.

Once the user receives the notification and taps the approval button, they will immediately be signed in.

"Passwords can be a hassle they're easy to lose track of and forget, or they are weak passwords that are vulnerable to hacking. At Yahoo, we are moving fast in our mission to kill the password' and make it easier for users to sign in without sacrificing security," said Yahoo product manager Lovlesh Chhabra in a blog post.

This new login method will appear for Yahoo Finance, Fantasy, Mail, Messenger, and Sports for iOS and Android.

Yahoo claimed this method of account verification is more secure than passwords. However, the company also said users must not sign out of their Yahoo app or turn off notifications "as this will prevent you from receiving your Account Key push notification".

Yahoo is not alone in its decision to explore new methods of user verification. Other web service providers have also been taking steps to move away from account passwords.

Bad passwords are one of the biggest reasons people's accounts are hacked, with the most commonly used password in 2015 being '123456'.

Music identification app Shazam does not use passwords at all, instead sending a verification email to the users when they attempt to sign to the app for the first time on a new device.

Google offers its Google Authentication app, which is used as an additional layer of verification, via randomised passcodes on the user's mobile device, for selected web services.

And the latest Apple devices, such as the iPhone SE and iPad Pro, include fingerprint sensors which enable user to confirm their identify simply by holding their finger to the devices home button.

Yahoo has stopped some of its customers accessing their email inbox if they are running ad blockers, in an attempt to dissuade people from using the software.

Customers in the US have reported seeing a message from the internet company asking them to disable their ad blocker before being able to view their inbox.

Although some users said they had been able to circumvent the message, others haven't been so lucky and were disappointed Yahoo was taking such steps. In fact, one customer, Andrei Herasimchuk - Yahoo's former Senior Director of Product Design, said he was planning to move to Apple Mail as a result of Yahoo's actions.

"So @YahooMail has blocked my inbox for using an ad blocker. It was a good run, I guess. Goodbye! Hello Apple Mail, as much as I hate it," he wrote on Twitter.

Yahoo said it had made the move as part of its US product testing scheme, but it didn't say whether it would continue to test the pop-up or disable it as a result of customer complaints.

The company explained only some users were seeing the message because it was A/B testing the ad blocker detecting technology.

"At Yahoo, we are continually developing and testing new product experiences. This is a test we're running for a small number of Yahoo Mail users in the US," a spokesperson told Engadget.

Yahoo is the latest company to restrict access to its website for those running ad blockers. In the past, high-profile companies including The Washington Post and City AM have trialled similar methods to encourage users to disable ad blocking tech.

Tom Yeomans, CEO of Yavli, a company that makes technology to subvert ad blockers, told Digiday: "They're likely testing this particular approach, banning ad blocker users, on their email service because they know their users will be forced to disable their ad blocker if they want to check their emails within their web browser.

"Their users' email account content are unique to them, so it's different from news content where they can visit a competing website to get a same or similar experience."

A huge malvertising campaign that took over Yahoo's advertising network for four days last month could have hundreds of millions of potential victims.

Cyber security firm Malwarebytes uncovered the attack yesterday, and said it is one of the largest it has witnessed, affecting ads run across Yahoo's home, news, finance, sports, celebrity and games pages.

The home page, yahoo.com, gets 6.9 billion monthly visits alone according to SimilarWeb, meaning four days worth of traffic constitutes 890 million visits.

Even if those are not all unique, it would still leave hundreds of millions of people at risk of the malware, whose payload may consist of ransomware CryptoWall and ad fraud Bedep.

"This [is] one of the largest malvertising attacks we have seen recently," said senior security researcher Jrme Segura, who added that the attack leveraged Microsoft Azure to redirect users to an Angler exploit kit.

"We did not collect the payload in this particular campaign although we know that Angler has been dropping a mix of ad fraud (Bedep) and ransomware (CryptoWall)," Seguras said.

He explained that malvertising is particularly dangerous because it doesn't require victims to take action to download the bugs it is enough to simply browse a website containing infected adverts.

"The complexity of the online advertising economy makes it easy for malicious actors to abuse the system and get away with it," Segura added.

Yahoo took measures against the attack as soon as Malwarebytes made it aware, and the campaign is no longer active.

A Yahoo spokesperson said: "Yahoo is committed to ensuring that both our advertisers and users have a safe and reliable experience. As soon as we learned of this issue, our team took action and will continue to investigate this issue.

"Unfortunately, disruptive ad behavior affects the entire tech industry. Yahoo has a long history of engagement on this issue and is committed to working with our peers to create a secure advertising experience. We'll continue to ensure the quality and safety of our ads through our automated testing and through the SafeFrame working group, which seeks to protect consumers and publishers from the potential security risks inherent in the online ad ecosystem."

Protecting yourself

However, the scale of the attack led some to ask just how secure Yahoo's systems are.

Grayson Milbourne, security intelligence director at cybersecurity firm Webroot, said: "This exploit raises serious questions about the size of this attack and Yahoo's security processes.

"[It] is an indication that potential breaches are heading in the direction of becoming more complex in nature, and with further reaching effects on a larger number of end-users."

Milbourne urged users to stick to the Chrome browser, coupled with anti-ad software, to avoid malvertising threats in future.

"Use the Chrome browser along with an ad-removal extension," he said. "There are number to pick from, and using this combination offers the best chance of preventing an ad network redirect to an exploit kit."

Facebook will have a new chief security officer (CSO) from Monday, having snapped up Yahoo's CISO Alex Stamos.

Stamos announced the move, perhaps predictably, via a Facebook post, in which he said the internet has been "an incredible force" for societal change at every level but that "these benefits are not without risk, and it is the responsibility of our industry to build the safest, most trustworthy products possible".

"There is no company in the world that is better positioned to tackle the challenges faced not only by today's internet users but for the remaining 2/3rds of humanity we have yet to connect," he said.

"The Facebook security team has demonstrated a history of innovation as well as a unique willingness to share those innovations with the world, and we will build upon that history in the years to come."

Stamos was a major force for change at Yahoo, leading a project to introduce end-to-end security for Yahoo Mail and also spearheaded the company's response to PRISM.

Colin Stretch, Facebook's general counsel, said Stamos is "a leader with deep technical security knowledge and experience. We're thrilled that he is joining Facebook as out new chief security officer to help us create an even bigger impact".

Stamos fills the shoes of Joe Sullivan, who left Facebook to join Uber in April this year. At Yahoo, Ramses Martinez, a senior director on its security team, will temporarily fill the role of CISO until the company has hired a permanent replacement.

Yahoo is to face a class action lawsuit accusing it of spying on users' emails to boost its ad revenue.

More than one million people are expected to take part in the case, after a Californian judge ruled that any Yahoo Mail users who sent or received an email from 2 October 2011 can sue.

Additionally, a group of people in California who did use Yahhoo's services may collectively sue the firm under the state's Invasion of Privacy Act.

Those users allege the tech giant copied and analysed their emails for keywords and attachments, aiming to turn the data into a targeted advertising campaign for its 275 million customers.

Yahoo derived 80 per cent of its income from search and display advertising last year.

The company told US District Judge Lucy Koh that some users had consented to its actions simply by continuing to email Yahoo addresses after learning what Yahoo was doing, but Koh rejected this argument.

Plaintiffs seek damages and a ban stopping Yahoo from spying.

Koh dealt with a similar case last year, when a class action lawsuit was brought against Google by Gmail users as well as non-Gmail users.

However, Koh rejected the case, saying it wasn't clear which users had and hadn't consented to Google's behaviour.

Yahoo missed its revenue and profit targets in its latest quarter, but continued to make money through its online advertising business.

Display advertising revenue rose 2.3 per cent to 310 million, which accounted for 40 per cent of its total revenues.

Meanwhile, search-based revenues increased 19.5 per cent year on year to 350 million.

Although revenues for this first quarter rose to 800 million, after taking all payments to ad partners off the total, Yahoo was left with 700 million.

Yahoo is breaking up its exclusive partnership to outsource search to Microsoft, in a bid to re-engage with the technology.

CEO Marissa Mayer has rewritten the terms of her firm's contract with Redmond, which for the last five years has seen all Yahoo search queries carried out by Microsoft's Bing engine, with Yahoo taking the bulk of ad revenue in return.

But now Yahoo can do what it likes with 49 per cent of its search enquiries, with Microsoft still carrying out the remaining 51 per cent.

Satya Nadella's company benefits too, by becoming the single advertising partner for all search results provided to Yahoo by Bing.

Mayer said: "Over the past few months, Satya and I have worked closely together to establish a revised search agreement that allows us to enhance our user experience and innovate more in our search business.

"This renewed agreement opens up significant opportunities in our partnership that I'm very excited to explore."

Yahoo will be able to tweak the search experience it provides on any platform, as the revamped partnership, covering desktop and mobile search, is non-exclusive.

That means the tech giant could send some search enquiries out to Google, but Yahoo might want to redevelop its own expertise in the field, too.

It marks a huge change from the previous shape of the partnership with Microsoft, signed by ex-Redmond boss Steve Ballmer and former Yahoo chief Carol Bartz in 2009.

The deal saw Microsoft pay Yahoo 88 per cent of the ad revenue it made from ads displayed alongside the Bing results Yahoo would present users with.

The original agreement would have seen this rise to 90 per cent for the remaining five years of the deal, but Mayer has chosen to take a different tack presumably to keep Yahoo's hand in the search business.

However, Microsoft doesn't seem too unhappy with the reworked agreement.

Nadella said in a statement: "Our global partnership with Yahoo has benefited our shared customers over the past five years and I look forward to building on what we've already accomplished together.

"Our partnership with Yahoo is one example of the diverse partnerships we'll continue to cultivate in order to have the greatest impact for our customers."

The EU's controversial "right to be forgotten" ruling against Google search results will now extend to Bing and Yahoo, The Wall Street Journal reports.

The ruling allows people living within the EU to request that certain "inadequate, irrelevant, or no longer relevant" information be removed from search results, though the web pages in question would remain online, but the rule had previously been restricted to Google results.

But that is about to change, as both Bing and Yahoo told the publication that they too would be abiding by the right to be forgotten ruling.

A spokesperson for Yahoo said: "We will carefully evaluate each request with the goal of balancing the individual's right to privacy with considerations of the public's right to information."

Similarly vague words came from Microsoft, with a spokesperson saying in a statement: "While we're still refining that process, our goal is to strike a satisfactory balance between individual privacy interests and the public's interest in free expression."

EU privacy regulators recently expressed their desire for requests to be removed from global sites, rather than just from European domains, after new guidelines were agreed to.

They said: "Limiting de-listing to EU domains on the grounds that users tend to access search engines via their national domains cannot be considered a sufficient means to satisfactorily guarantee the rights [of people]."

Though Google has been inundated with requests since the ruling was put in place, it has reportedly removed just 40 per cent of the 175,000 requests it has received to date. A third of these come from UK sources.

Yahoo Mail users have been hit by service problems for over a week as engineers battle to repair an undersea cable.

The cable was accidentally cut during routine maintenance work leaving UK and US users unable to access their accounts and others facing slow page loading times. The worst affected regions appear to be eastern US and western Europe.

Sky and BT customers were also affected, as both use Yahoo to provide email services to their users.

"We are aware that Yahoo Mail is slow or inaccessible for some of our users. The issues were a result of an underwater fibre cable cut, caused by a third party while fixing a separate cable," the firm said on its status page.

"The engineering team has rerouted email traffic to mitigate accessibility issues. A cable repair ship has been mobilised and will be at the site this weekend."

The notice added: "Some Yahoo Mail users are experiencing delays in accessing and viewing their mail. We'll be posting updates regularly on this page to keep everyone informed of our progress. Thank you for your patience as we work to fully resolve this."

The firm apologised for the inconvenience and said it understood that email was "a critical service" for its customers.

Disgruntled users have taken to social networking site Twitter to vent their frustrations about the service problems.

"If yahoo was #rbs they'd be fined 56m for locking us out of our accounts. How am I expected to run my business with #yahoomaildown?" tweeted one angry user.

The firm has not yet said when service would completely resume, but users are advised to follow Yahoo's Customer Care Twitter account @YahooCare for updates.

Update: According to Yahoo Mail's status page, engineers have located the underwater cable affecting its network. "Testing and repairs are currently taking place. The Yahoo engineering team continues to monitor email traffic. Thank you for your patience," it said.

Users once more took to Twitter to air their disgust.

"Yahoo mail is down again. Can't send emails. Do you ever notice that you never hear that Google Mail is down? #yahoomail #yahoomaildown," said Twitter user Mark LoPresti.

Mozilla has ditched Google as its default search engine after a 10-year agreement between the companies came to an end.

Firefox will now use Yahoo as its default search engine in the US from December. Under the terms of the five-year deal, Yahoo will support Do Not Track (DNT) within Firefox.

Google, Bing, DuckDuckGo, eBay, Amazon, Twitter and Wikipedia will remain as alternate search options for users who want to manually switch.

In Russia, Yandex Search will be the default search provider and Baidu will remain the defacto engine in China.

The global partnership between Google and Mozilla has not been renewed either but the popular search engine will still be pre-installed.

"Google has been the Firefox global search default since 2004. Our agreement came up for renewal this year, and we took this as an opportunity to review our competitive strategy and explore our options," noted Chris Beard, Mozilla CEO in a blog post.

"We are ending our practice of having a single global default search provider. We are adopting a more local and flexible approach to increase choice and innovation on the web, with new and expanded search partnerships by country."

Mozilla claims its Firefox browser accounts for 100 billion web searches per year - so this looks like a significant coup for Yahoo.

One of technology's most prominent women, Marissa Mayer has been responsible for pulling Yahoo back from the brink.

For years, Mayer was a high flyer in Google, being a major contributor to the search engine's look and feel. Once she had become Yahoo's chief executive, Mayer was one of only twenty women in charge of a Fortune 500 company.

Full name: Marissa Ann Mayer

Date of birth: 30 May 1975

Nationality: American

Net worth: $300 million

Salary: $117 million over 5 years; $36.6 million for first six months

Education: Stanford University (BSc and MSc Computer Science). For both degrees, her specialism was in artificial intelligence. In 2009, the Illinois Institute of Technology gave Mayer an honorary doctorate in recognition of her work in the field of search.

Best Known for: Being one of the most powerful women in technology

Current role: Chief executive of Yahoo

Career history: Mayer joined Google in 1999 as employee number 20 and was the firm's first female engineer.

She became known for her attention to detail while devloping and designing Google's search offerings.

Soon Mayer became a product manager and then director of Consumer Web products.

In 2005, she was promoted to vice president of Search Products and User Experience. she held key roles in a number of Google products including search, news, maps and Gmail.

She was vice president of Google Product Search until the end of 210 when then-CEO Eric Schmidt moved her onto head up Local, Maps and Location Services.

It then looked as if her career at Google stalled when others that joined google later than her were promoted past her. Activist shareholders in Yahoo, sought her out for a role heading up Yahoo, in a bid to turn the ailing company around.

In July 2012, Mater assumed the role of CEO, the fifth one in as many years.

In September 2013, Mayer was ranked number one by Fortune magazine's annual "40 under 40", the first woman to do so.

Also in 2013, Mayer embarked on Yahoo's first acquisition with her in charge, buying Tumblr for $1.1 billion.

In November 2014, Yahoo announced plans to acquire BrightRoll for $640 millio in a bid to bolster its video ad efforts. That month, reports also started circulating suggesting some members of Yahoo's board wanted a merger with AOL and the new, combined, firm to be headed up by AOL CEO Tim Armstrong instead of Mayer.

In addition to Yahoo, Mayer also sits on the board of Jawbone and Walmart as well as several non-profit organisations.

Interesting fact: Mayer lives in a penthouse suite at the Four Seasons Hotel in San Francisco with her husband and their son.

Photo: Fortune Live Media (Creative Commons)

This article was originally published on 13/10/2014 and has been updated multiple times (most recently on 13/11/14).

Yahoo has bought video advertising platform BrightRoll for $640 million.

The deal is the second major one to be carried out under chief executive Marissa Mayer after last year's $1.1 billion Tumblr acquisition.

BrightRoll will help in strengthening Yahoo's efforts in video ads, merging Yahoo's desktop and mobile video advertising business with BrightRoll's programmatic video platform, according to Yahoo. It added the deal would help it become the "biggest video advertising platform" in the US.

Mayer said that Video along with mobile, social and native is "driving a surge in digital advertising".

"[Yahoo is] a large, growing and profitable business with net revenues expected to exceed $100 million this year. I've spent time with Tod Sacerdoti and his leadership team and I cannot wait to have him, his vision, and his team here at Yahoo," Mayer added.

She added, in a blog post: "Online video advertising is increasingly fragmented across thousands, if not millions, of sites and mobile apps. More so than with traditional broadcast television, advertisers are seeking ways to buy online video advertising at scale across many sites in fewer, simpler transactions."

Tod Sacerdoti, BrightRoll CEO and founder, said he believed the next step for programmatic video advertising as an industry is to "extend and standardise globally, make cross-device buying simple and measurable, and complement and integrate with TV."

He added: "We are excited to join Yahoo to materially advance efforts in each of these areas. We're still in the early innings as an industry, and together, BrightRoll and Yahoo are committed to the vision of helping grow the entire video advertising ecosystem."

Last October, Yahoo reported third quarter ad revenue had decreased by five per cent compared with the same period in 2013. This means it is struggling to keep up with Google, whose own revenues grew by 17 per cent grow in its third quarter.

Yahoo said it expects the deal to close in the first quarter of 2015. Until then, BrightRoll will continue to offer its current suite of products and services.

In other news, investors have signalled they are unhappy with the direction of the Yahoo as a company. As reported by IT Pro's sister publication PC Pro, two of Yahoo's biggest investors want the company to merge with AOL, and let AOL chief executive Tim Armstrong take over the combined company, pushing Mayer aside.

The US government made 6,791 requests for data to Yahoo in the first six months of the year, more than twice the number made by any other country.

According to Yahoo's Government Data Requests report, the firm received 2,872 requests for data by Germany (second only to the US), while the UK submitted 1,408 requests.

However, out of these 6,971 requests by US authorities, only 382 were rejected by Yahoo. The firm rejected 575 requests from the UK while Germany saw 1,529 of its requests (over half) fall on deaf ears at Yahoo.

In the report, Yahoo said that while it complied with lawful requests for data, it carefully scrutinised "each request to make sure that it complies with the law, and we push back on those requests that don't satisfy our rigorous standards."

In a blog post, Yahoo general counsel Ron Bell, said the publication of the report was to continue "our efforts to provide as much information as we can about government requests for our users' data and government requests to remove content".

He said, despite handing over data to authorities, Yahoo's users would "always come first".

Bell added the firm would "narrowly" interpret government requests to minimise disclosure of user data, contest requests it believed may violate a user's human rights, including rights to privacy or free expression as well as publish its transparency report.

"An important example of how we put users first is our recent effort to push the US Government to release 1,500 pages of once-secret documents detailing our 2007-08 challenge to the expansion of US surveillance laws," said Bell. "We are still pushing for the FISC to release additional materials from this case.

"Through the Reform Government Surveillance Group, we are advocating for reform to ensure that US surveillance laws are transparent, reasonable and subject to independent oversight," he added.

"On the international front, a number of countries seek to expand their surveillance authorities beyond their borders. We will continue our efforts to protect your information from unclear, improper, overbroad or unlawful government requests."

Yahoo is to follow Google in rolling out end-to-end encryption for users of its email service in a bid to keep users' correspondence private.

Announcing the move at the Black Hat security conference in Las Vegas, Yahoo's chief security officer Alex Stamos said that, from the Autumn, it would be rolling out PGP encryption to users.

This will be offered through a modified version of technology used by Google to secure its Gmail service. It will be enabled via a browser plug-in.

A few months ago, Google also announced plans to offer a Chrome browser extension to allow its users to encrypt emails. Yahoo's encryption will be compatible with that of Google's.

Two users with the plug-in enabled will be able to send each other emails with the data encrypted, making it unreadable to anyone but the sender and recipient. While it's been possible to encrypt emails for a number of years, such technology has been beyond the capabilities of most people. The plug-ins aim to simplify this process.

"If an activist in Sudan wants to email a human rights organization's gmail address and they have encryption set up for it, it will automatically detect that and offer them the option to encrypt," Stamos told delegates at the conference.

While the subject line won't be encrypted, the rest of the main body of content will. Such encryption means that neither Yahoo nor Google would then be able to scan through the content in order to serve up matching advertising. Stamos, however, predicted there would be no adverse impact on revenue by introducing the measure.

The firm has also updated its mobile email apps for the iPhone and iPad. In a tweet, Stamos said this mobile app will natively run the encryption found in the browser plug-in.

The updated apps will also enhance search functionality, making it easier for users to find people and messages they require via its Smart Search Suggestions.

Android versions of the email app are expected in the coming weeks.

Google, Microsoft and Yahoo will convene to discuss the controversial Right to be Forgotten law with EU privacy officials next week.

The three tech companies will talk about the impact of introducing the law -which came into force in May - ontheir customers and the public in general.

The Right to be Forgotten ruling means that anyone can request information about them be removed from search engines deemed ""inadequate, irrelevant or no longer relevant, or excessive" but it's up to search engines themselves to decide how to go about removing the links.

Google started stripping out search results in May, after it received 70,000 requests to remove such links, although since then it hasbacktracked a little and has started restoring some of the links to articles.

Microsoft has recently opened a forum where its users can request that articles relating to their namebe removed. However, because Bing's marketshare is so much smaller than Google in the EU, it's thought the search engine won't receive a high volume of requests.

The form says the search engine will "consider the balance between your individual privacy interest and the public interest in protecting free expression and the free availability of information, consistent with European law. As a result, making a request does not guarantee that a particular search result will be blocked."

Although none of the companies have publicly revealed what they plan to talk about when they attend EU HQ in Brussels next week, Google and Microsoft said they will co-operate with the organisations.

Many media companies and other companies who rely on search results to give their brand visibility have said the ruling is creating a censorship whitewash and influencing search results in such a way.

Earlier this week, a new website showing Google's blocked searches showed up online. Hidden from Google claims to have received hundreds of responses alerting them to search results hidden by the search engine.

Last week, the UK Government demanded that the EU's Right to be Forgotten law be dropped, saying it is "in the wrong position."

Chinese users will finally be able to use Google services following the 25th anniversary of the Tiananmen Square massacre.

The disruption began in the run up to the anniversary, with the government blocking the search, maps and email functions provided by the US company.

China has long maintained a tight grip on its internet in order to keep a careful eye on any signs of dissent from within.

According to journalists from Reuters, access to Google search was limited but if it was finally made (through the maps section) users would be directed to the Hong Kong version.

Anti-censorship group GreatFire also reported that the Google services appeared to be returning to normal following the anniversary.

"I'm not sure if it's a temporary glitch or a change of policy," a member of the group, posting anonymously, said. "If Google indeed is unblocked, it's a big victory for free speech."

They added that it could only be a good thing, especially as Google uses the censorship blocking HTTPS encryption style for their search engine.

That does not mean the company won't back down to Chinese demands and remove it, however.

"If Google were to back down and disable HTTPS by default for Chinese users it would be a victory for the authorities," the member told Live Mint.

Sites other than Google were affected by the disruption, too. Yahoo, Flickr, OneDrive and two popular mobile messaging apps in South Korea all reported disruption in China.

China has a history of knee-jerk reactions in regards to tech and the internet. In April it banned government officials from using Windows 8 on its computers. The country has also blocked Facebook, Twitter and YouTube in previous years.

Apple is continuing to separate itself from outside companies by ceasing to use Yahoo's weather service app, switching instead to The Weather Channel.

The weather app for iOS 8 will use services from The Weather Channel instead of Yahoo. Yahoo has been using data from The Weather Channel to provide information to the app regardless, with the move merely serving to eliminate the "middle man".

David Kenney, ex-Yahoo board member and Weather Channel CEO, has reportedly been developing the app for some time. With the iOS weather app, information such as extended forecasts and location-aware weather data will now be available to users.

Reports are also stating that the iOS 8 weather app includes text descriptions of the day's conditions, including time of sunrise and sunset, chance of rain, wind speed and direction, humidity percentage and "feels like" temperature.

The decision to drop the service from the iOS 8 app marks the end of a seven year partnership between Apple and Yahoo. The move away from using certain other companies for apps reflects Apple's previous move of opting to use Bing as its default search provider over Google.

BT "exposed user credentials en masse" as it migrated customer emails from a Yahoo-powered system to its own infrastructure, it has been alleged.

According to reports, a whistleblower, believed to be a former employee of Critical Path, the company that built BT's new system, has claimed the method being used for the gradual moving of email accounts from one system to the other is unsecure.

The individual reportedly contacted the ICO, claiming the company was running a "chaotic" mail system for BT that may have contravened UK data protection legislation.

According to The Register, which claims to have seen the complaint documents, user IDs and passwords of BT customers were allegedly logged by Critical Path.

It is reported that the whistleblower claimed to have become concerned by "careless implementation of security safeguards affecting the privacy of BT internet mail users".

"Critical Path was running a set-up during migration that exposed user credentials en masse as login proxies connected via load balancers to Yahoo!, with only traffic between load balancers and Yahoo! Being encrypted and the rest circulating around the infrastructure in clear text," The Register's source claimed.

IT Pro contacted the ICO for confirmation of whether or not BT is under investigation.

An ICO spokesperson said: "On 13 March 2014 we wrote to BT with a number of questions. Our enquiries into this matter are still ongoing and no conclusions have yet been reached."

BT told IT Pro: ""BT has been made aware by the ICO that they are conducting an unverified assessment in relation to BT Mail security, a service which is provided by Openwave (formerly Critical Path).

"BT takes the security of all products very seriously and, in the process of developing new services with partners, we rigorously audit and test for security, and fix any identified issues before going into live service. We believe this unverified assessment of BT Mail relates to an issue identified and fixed as part of our normal testing and development process."

• This article was updated to include BT's response to the allegations.

GCHQ, the UK Government listening post, intercepted the web chats of millions of Yahoo customers in a programme codenamed Optic Nerve, it has been alleged.

According to documents shared with The Guardian by Edward Snowden, users who were not suspected of any wrongdoing had their webcam images intercepted and stored by the British intelligence agency, working in collaboration with its American counterpart the NSA.

The Guardian claims the documents it has received show the programme from 2008 until at least 2012 and was being used for experiments in facial recognition.

Those targeted would, without their knowledge or consent, have a freeze-frame image from their chat taken every five minutes and stored by the NSA, the publication said.

It is alleged that in just one six-month period in 2008 the agency collected webcam images "including substantial quantities of sexually explicit communications" from over 1.8 million Yahoo user accounts worldwide.

Indeed, the scale of intimate imagery being collected through Optic Nerve between 3 and 11 per cent was believed to contain "undesirable nudity" led to GCHQ trying to find a way to make it "safer to use".

The revelation that Yahoo's webcam chat facility has allegedly been used as a conduit for broad-based, untargeted spying has provoked a furious response from the internet giant.

In a statement, Yahoo said: "We were not aware of nor would we condone this reported activity. This report, if true, represents a whole new level of violation of our users' privacy that is completely unacceptable and we strongly call on the world's governments to reform surveillance law consistent with the principles we outlined in December.

"We are committed to preserving our users' trust and security and continue our efforts to expand encryption across all of our services."

Internet giant Yahoo has acquired New York-based journaling startup Wander for an undisclosed sum, as it continues to flesh out its mobile app portfolio.

The company's flagship product is called Days, which is an iPhone app that encourages users to record daily events as visual diaries with images and gifs. The images are combined into a "day," which can be shared later with friends.

"We've spent the past few years figuring out how to make content creation as habitual as content consumption," the Wander team said in a blog post.

"We're excited to announce that we've accepted an offer to bring our work on daily habits to Yahoo."

Wander said Days will continue as a "standalone entity", although the Wander team will join Yahoo's Mobile and Emerging Products group in New York to work on "exciting" projects.

Yahoo has not disclosed how much it paid for the company, although TechCrunch suggests it could have parted with "north of $10 million".

The purchase follows a series of acquisitions made by Yahoo since CEO Marissa Mayer took charge in July 2012. In that time, it's bought 27 companies, many of which were small start-ups, with the exception of social blogging platform Tumblr.

Yahoo tends to buy small apps to recruit talented young developers to improve its existing products. The team behind the app Stamped, Mayer's first purchase, was folded into Yahoo's Mobile Properties team.

"At some point [in the near future] we'll have to be a predominantly mobile company," Mayer said in October 2012. "The future of Yahoo is extraordinarily bright."

Yahoo claims to have thwarted a bid by hackers to gain unauthorised access to its users' email accounts.

The internet giant said in a blog post the list of user usernames and passwords needed to carry out the attack is likely to have been obtained from an attack on a third-party database.

"We have no evidence that they were obtained directly from Yahoo's systems," wrote Jay Rossiter, senior vice president of platforms and personalisation products at Yahoo.

The usernames and passwords were then used by "malicious software" to access people's accounts, according to Yahoo.

"The information sought in the attack seems to be names and email addresses from the affected accounts' most recent sent emails," the post continued.

The company said, upon discovering the attack, it took immediate action to protect affected users by sending out password reset prompts.

"We are resetting passwords on impacted accounts and we are using second sign-in verification to allow users to re-secure their accounts," the company said.

"Impacted users will be prompted (if not, already) to change their password and may receive an email notification or an SMS text if they have added a mobile number to their account."

Furthermore, Yahoo said it is working with law enforcers to bring the people responsible for the attack to justice. It also moved to assure users that additional measures have been put in place to prevent further attacks on its systems.

"We regret this has happened and want to assure our users that we take the security of their data very seriously," the blog post concluded.

Yahoo has confirmed a number of ads on its European sites were serving malware to visitors for three days over the New Year period.

The issue was first noted by Dutch IT security company Fox-IT, which said in a blog post it had detected and investigated infections suffered by clients who had visited yahoo.com.

According to the organisation, those who clicked on the ads were redirected to a Magnitude exploit kit, which can install various different malware including ZeuS, Andromeda and Necurs.

The malicious ads first appeared on 31 December until 3 January, after Yahoo removed them.

A Yahoo spokesperson told IT Pro: "At Yahoo, we take the safety and privacy of our users seriously. From December 31 to January 3 on our European sites we served some advertisements that...spread malware. Users in North America, Asia Pacific and Latin America...were not affected. Additionally, users using Macs and mobile devices were not affected."

The company said it is continuing to monitor the adverts appearing on its sites for any other suspicious activity.

Further information for users will also be posted shortly, the spokesperson said.

Tech firms including Apple, Facebook and Google have co-authored and co-signed a letter to US President Barack Obama and the US Congress petitioning them to reform government surveillance practices across the globe.

The action has been taken in light of continuing revelations from former NSA contractor Edward Snowden regarding the widespread use of interception techniques by the American National Security Agency (NSA) and its UK equivalent GCHQ to monitor internet traffic and electronic communications.

The letter, which has been published on reformgovernmentsurveillance.com, says: "We understand that governments have a duty to protect their citizens. But this summer's revelations highlighted the urgent need to reform government surveillance practices worldwide.

"The balance in many countries has tipped too far in favour of the state and away from the rights of the individual rights that are enshrined in our Constitution. This undermines the freedoms we all cherish. It's time for a change."

The companies, which include AOL, Apple, Facebook, Google, LinkedIn, Microsoft, Twitter and Yahoo, are urging the US to take the lead in carrying out this reform.

In an individual comment posted on the same website, Larry Page, Google's CEO, said: "The security of users' data is critical, which is why we've invested so much in encryption and fight for transparency around government requests for information.

"This is undermined by the apparent wholesale collection of data, in secret and without independent oversight."

Facebook CEO Mark Zuckerberg added: "Reports about government surveillance have shown there is a real need for greater disclosure and new limits on how governments collect information.

"The US government should take this opportunity to lead this reform effort and make things right."

However, Rafael Laguna, CEO of open source software firm Open-Xchange, criticised their arguments as "flawed".

"This very public display of unity is essentially an acknowledgement from these large internet companies the public has begun to lose trust in them, and as a result in the internet as a whole.

"However, a fundamental flaw in their argument is the double standard of condemning governments for data surveillance, while at the same time harbouring the unquantifiable amounts of data that governments wish to access in the first place."

He added: "Charity begins at home, and the first step to rebuilding trust in an open internet is to address their own data retention policies before pointing the finger elsewhere."

Further revelations from the Snowden Papers this week include the infiltration of Massive Multiplayer Online (MMO) games, such as World of Warcraft, and digital communities by the NSA and GCHQ in order to spy on and, in some cases attempt, to recruit users.

Separately, Washington Post has allegedly uncovered the FBI's use of malware in order to track down a suspect who made repeated bomb threats online.

The agency also requested to be allowed to activate the suspect's webcam remotely, but a judge ruled such an action would be excessively intrusive and could violate his fourth amendment right to protection from unreasonable searches and seizures.

Yahoo is to introduce encryption across its services in a bid to prevent intelligence services, such as the NSA, from snooping on its users.

The decision to encrypt communications was announced in a blog post by the firm's CEO Marissa Mayer. She said the web portal remained committed to protecting its users' privacy and data.

"There have been a number of reports over the last six months about the US government secretly accessing user data without the knowledge of tech companies, including Yahoo. I want to reiterate what we have said in the past: Yahoo has never given access to our data centres to the NSA or to any other government agency. Ever," she said.

"There is nothing more important to us than protecting our users' privacy. To that end, we recently announced that we will make Yahoo Mail even more secure by introducing https (SSL - Secure Sockets Layer) encryption with a 2048-bit key across our network by January 8, 2014. Today we are announcing that we will extend that effort across all Yahoo products."

This means all information passing through Yahoo's servers and data centres will now be encrypted and Yahoo email clients will use HTTPS. It plans to complete the process by the first quarter of 2014.

We've worked hard over the years to earn our users' trust and we fight hard to preserve it," said Mayer.

"As we have said before, we will continue to evaluate how we can protect our users' privacy and their data. We appreciate, and certainly do not take for granted, the trust our users place in us."

The move to encrypt data comes after the highly embarrassing revelations that US and UK spy agencies collected data from a number of tech companies. The news came to light after leaks from whistleblower Edward Snowden that claimed the NSA had been secretly monitoring data passing between Yahoo and Google.

Yahoo is selling off more than 100 of its dormant domain names in a week-long auction, a move that could net the internet search firm millions.

The auction was announced in a blog post by Kevin Kramer, deputy general counsel at Yahoo, and follows the discovery of a long list of "premium" domain names the company has owned for some time.

"As we discussed what to do with them, it became obvious that it was time to set them free...back into the wild of the internet. Surely, creative people, businesses and entrepreneurs could come up with something great to do with them. They could even spark some brand new ideas or companies," said Kramer.

Some of the domain names up for grabs include "crackers.com", which boasts a reserve price of between $25,000 and $49,000, while "webserver.com" is being offered with a maximum reserve of $499,000.

The "av.com" domain name currently sports a reserve price of $1 million to $1.49 million, making it one of the most expensive featured in the auction.

For those in the market for something a little cheaper, in the $500 to $999 reserve price bracket are the names "purplepedals.com" and "myfanpages.com".

Yahoo has promised further names will be released during the auction week, which starts today and runs until 21 November.

The move is the latest in a long line of fundraising and cost cutting initiatives Yahoo has embarked under the watchful eye of CEO and president Marissa Meyer, who joined the firm in July 2012.

In that time, Meyer has introduced a ban on remote working for Yahoo employees and has overseen the shutting down of the firm's underperforming or less popular internet services.

Leaked confidential documents suggest the NSA has been secretly harvesting data from Google and Yahoo networks, giving the agency access to hundreds of millions of emails accounts.

Operating under the name Project Muscular, the NSA is believeed to have been using an unnamed telecoms provider to gain access to relevant cables/switches that Google and Yahoo use to transfer data.

Data of US and foreign civilians has been intercepted at point outside of the US, documents obtained by former NSA contractor-turned whistle blower Edward Snowden reveal.

Accounting data from 9 January 2013 shows the NSA processed 181,280,466 new records in a 30-day period. The documents suggest the NSA was not only gathering metadata but snooping on the text, audio and video content within emails.

Google expressed outrage at these latest developments, re-iterating that it does not provide the US government with access to its systems.

"We have long been concerned about the possibility of this kind of snooping, which is why we have continued to extend encryption across more and more Google services and links, especially the links in the slide," said David Drummond, Google's chief legal officer.

"We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform."

Meanwhile, Yahoo appeared to claim that its data centers have not been compromised.

"We have strict controls in place to protect the security of our data centers, and we have not given access to our data centers to the NSA or to any other government agency," the firm said in a statement.

The NSA denied that it collects vast quantities of data from US citizens in this manner - claiming that it is focused on gathering foreign intelligence.

"NSA applies Attorney General-approved processes to protect the privacy of US persons - minimising the likelihood of their information in our targeting, collection, processing, exploitation, retention, and dissemination," the agency said in response to the allegations.

"[We're] focused on discovering and developing intelligence about valid foreign intelligence targets only."

Yahoo has announced an overhaul of its security bug bounty programme, after being criticised for rewarding researchers who uncover flaws in its products with discount branded goods.

The internet giant came under fire earlier this week after researchers at IT security services provider High-Tech Bridge claimed they were offered a $12.50 discount code as a reward for uncovering a Cross-Site Scripting XSS flaw in Yahoo Mail.

The discount was only redeemable against Yahoo branded products sold by its corporate store.

The policy has enraged the security research community, with many claiming the reward scheme offers little incentive to report bugs.

However, in a blog post, Yahoo said it has been working on a revised rewards programme for some time now, which it has decided in light of this week's reports to introduce slightly earlier than planned.

"We recently decided to improve the process of vulnerability reporting...This month the security team was putting the finishing touches on the revised programme," explained Ramses Martinez, director of Yahoo Paranoids.

"And then yesterday morning...my inbox was full of angry email from people inside and out of Yahoo. How dare I send just a T-shirt to people as thanks?

"So, rather than wait any longer, we've decided to preview our new vulnerability reporting policy a bit early."

Under the reworked system, Yahoo will now hand out cash rewards of between $150 and $15,000 for "new, unique and high-risk" issues, with payment size dependent on the severity of the issue.

The company has also vowed to respond, review and fix bugs faster than ever before.

The new policy will come into force on 31 October 2013, but the benefits will be offered to anyone who has reported a bug since 1 July 2013.

"If you submitted something to us and we responded with an acknowledgement (and probably a T-shirt) after July 1, we will reconnect with you about this new program. This includes, of course, a cheque for the researchers at High-Tech Bridge who didn't like my T-shirt," he added.

Martinez also used the post to defend the company's existing rewards programme, explaining the firm started offering T-shirts and company store discount as a personal acknowledgement of the researcher's efforts.

"When I first took over the team that works with the security community on issues and vulnerabilities, we didn't have a formal process to recognise and reward people who sent issues to us," explained Martinez.

"I started sending a t-shirt as a personal thanks'. It wasn't a policy, I just thought it would be nice to do something beyond [sending] an email."

After a while, regular Yahoo bug finders said they had already received T-shirts as a reward for their efforts, so Martinez decided to buy them gift certificates so they could buy another item of their choosing from the company store.

Both the T-shirts and the gift certificates were paid for using Martinez's own money, he claimed, and he also took the time to write letters thanking people for uncovering bugs.

"Most companies offer just a thanks, maybe some schwag, for identifying a potential vulnerability. There are those that offer money," he added.

Yahoo is facing claims its decision to recycle inactive email addresses has resulted in some users receiving personal messages intended for the previous owner.

The internet giant announced plans earlier this year to recycle Yahoo usernames, or IDs, that had not been used for more than 12 months to free up long-held ones that others might want.

Users were told to fill out a wish list, detailing their top five potential usernames. Yahoo would then inform them if their top picks were available and, if so, users were given 48 hours to claim it.

At the time, the company assured users it was working with social media and e-commerce sites to update them about the change in ownership of certain usernames to prevent personal information being passed on about the previous owner.

However, in a recent Information Week article, several Yahoo email users said they had received marketing newsletters, Facebook messages and digital receipts for purchases the former address holders had made.

Dwayne Melancon, chief technology officer at security software vendor Tripwire, said he wasn't surprised by the reports.

"After all, if you change mobile numbers your phone number goes back into the pool of available numbers at some point. Anyone who still has your old number will reach the new mobile phone subscriber, rather than you. With recycled emails, it's no different," he said.

"From a security perspective, this is a great case for using email encryption when transmitting sensitive information. With encryption, even if a new owner takes over your contact's old email address, they will be unable to read the sensitive data because they will not have the encryption key required to decipher the message," he added.

In a statement to IT Pro, a Yahoo spokesperson said the firm has done a lot of work to secure users' personal information as part of its email recycling efforts.

"Before recycling inactive accounts we attempted to reach the account owners [in] multiple ways to notify them that they needed to log in to their account or it would be subject to recycling," the statement read.

"Before recycling these accounts, we took many precautions to ensure this was done safely including deleting any private data from the previous account owner, sending bounce-backs to the senders for at least 30-60 days letting them know the account no longer existed and. unsubscribing the accounts from commercial mail."

The company also undertook marketing campaigns and worked closely with other email service providers, merchants and third parties to make them aware that some addresses would be switching owners.

It is also in the throes of rolling out a system that will allow users to flag when they receive an email that is not intended for them.

"We continue to look for ways to protect our users," the statement concluded.

Internet companies including Google, Facebook, Microsoft and Yahoo were paid millions of dollars by the NSA to cover the cost of participating in the Project Prism data collection programme.

Declassified documents showed the Foreign Intelligence Surveillance court (FISA) ruled the NSA was violating the 4th Amendment (prohibiting unreasonable seizures and searches) in a October 2011 ruling.

The court deemed the NSA was breaching the 4th amendment because it was unable to separate domestic communications from foreign traffic.

Up until this ruling, the NSA had relied on the FISA court to provide annual certifications for data collection. After the ruling these were limited to temporary renewals.

Further documents released by the Guardian appear to show this coincided with a financial relationship between the NSA and the high-profile firms.

"Last year's problems resulted in multiple extensions to the certifications' expiration dates which cost millions of dollars for PRISM providers to implement each successive extension costs covered by Special Source Operations," noted a top-secret memo from the NSA dated December 2012.

In a statement, Yahoo acknowledged that it had been reimbursed for the compliance procedures that it had been obliged to follow.

"Federal law requires the US government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government. We have requested reimbursement consistent with this law," the web giant noted.

Similarly, Microsoft claimed it only ever complies with court orders because it is legally required to and not because it is paid for the work.

"We [Microsoft] could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive," the firm said in a statement.

Meanwhile, Google noted that it is still waiting for the US government to publish more information about data requests.

"We await the US government's response to our petition to publish more national security request data, which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today," Google said.

Yahoo has outperformed rivals Google and Microsoft in terms of internet traffic across all its sites for the first time in several years.

According to internet analytics firm ComScore, Yahoo attracted 196,564,000 unique US visitors to its sites in the month of July, compared to 192,251,000 for second place Google and 179,494,000 for Microsoft.

This represents an increase of 7,837,000 unique visitors for Yahoo, while Google's figures actually shrank by 339,000 the third month in a row it has experienced a decline.

Yahoo also managed to top ComScore's Ad Focus ranking, which measures top ad-focused sites and networks in order of audience size.

Yahoo has been steadily increasing the number of visitors to its sites since Marissa Mayer took over as CEO in July 2012.

She has credited the slow and steady recovery of the 19-year-old company to changes she has made since her appointment, which has included the acquisition of blogging site Tumblr for $1.1 billion (704.47 million) in May 2013.

Yahoo also recently announced its acquisition of social web browser firm RockMelt.

Mayer said she hopes to end a 10-year search revenue deal that was signed with Microsoft in 2010 to use the latter firm's Bing search engine, after she publicly claimed Yahoo was not benefiting financially from the agreement.

However, despite the upbeat news from ComScore, Yahoo reported a drop in revenues in July due to a reduction in display advertising and search revenue of 13 per cent and 9 per cent respectively. This led to a 1.7 per cent share price drop.

Representatives from the world's biggest internet firms will meet with Culture Secretary Maria Miller today to tackle the prevalence of child abuse images online.

The meeting is expected to be attended by representatives from Google, Facebook, Microsoft, Twitter and Yahoo, as well as ISPs Talk Talk, O2, BT and Sky.

The attitudes of ISPs, search engines and social media networks to halting the spread of child abuse images online has come under close scrutiny in the wake of the April Jones and Tia Sharp murder trials.

In both cases, the perpetrators were found to have trawled the internet for child abuse images, prompting calls for web firms and ISPs to do more to restrict access to such content.

The Prime Minister David Cameron led calls earlier this month for members of the technology industry to pool resources to prevent online access to child pornography.

In a statement at the time, he said: "The time for excuses and blame is over. We must all work together [because] the safety of our children is at stake and nothing matters more than that."

As reported by IT Pro yesterday, Google has announced a $7 million package of measures to help clamp down on offensive web content.

The money will be invested in organisations and technology tools that can be used to remove the child abuse images from the net.

Further to this, BT recently set out plans to send an alert to customers that attempt to access web pages listed on the Internet Watch Foundation's database of child abuse images.

This message will inform them that access to the site has been blocked, as well as the reason why.

Ahead of today's meeting, Miller referenced the recent efforts that have been made in this area, but stressed there is still more to do.

"Child abuse images are horrific and widespread public concern has made it clear that the industry must take action," she said.

"In recent days we have seen these companies rush to do more because of the pressure of an impending summit.

"Imagine how much more can be done if they seriously turn their minds to tackling the issue. Pressure will be unrelenting," she added.

BT has ditched Yahoo as part of a revamp of its online and email services.

The telecoms giant has confirmed it will close the BT Yahoo portal during the summer and that users with a BT Yahoo email account will be also be switched over to the BT mailbox.

All messages will remain intact and email addresses will be the same, but users may be prompted to change their password, BT said.

There is not timeframe for the switch, but it will occur before the end of the year.

"During the summer, the BT Yahoo portal will close, but customers will be able to access their BT Yahoo Mail account by clicking on a link from BT.com. Later in the year, customers will be moved to BT Mail," the firm said in a statement.

Nick Wong, director of online for BT's consumer division, claimed customers would get all the features they expect from a modern email service.

"[BT Mail] will also feature in-built anti-virus and anti-spam solutions. We will be keeping our customers fully informed about what changes to expect and when they will be able to enjoy the new services."

This will be the second largest email switchover this year, with Microsoft already moving Hotmail users to its rebranded Outlook.com service, and experiencing a major backlash.

The move is a blow to Yahoo, which is already struggling to re-assert itself as a dominate player in the online world.

Meanwhile, BT continues to grow its customer base on the back of its high-speed broadband services. The firm has over 1.5 million customers using broadband with 270,000 fibre connections in the last quarter.

This number is expected to grow as BT pushes ahead with an aggressive strategy, which undercuts competitors such as BSkyB and Virgin.

Earlier in May, the firm announced that all BT Broadband customers would get free access to its three sports channels. This will include coverage of 38 Barclays Premier League matches, as well as access to Rugby and Tennis events.

BT.com is also set to be relaunched in June to support the firm's new content delivery model.

Hackers have stolen the login names of 22 million Yahoo users in Japan, prompting the internet search giant to urge people to change their passwords immediately.

The company said the details were contained in a file that may have been stolen during an attack on its systems, which was picked up by Yahoo on 16 May.

"We don't know if the file (of 22 million user IDs) was leaked or not, but we can't deny the possibility given the volume of traffic between our server and external [terminals]," said the company in a statement to AFP.

However, the company has been quick to stress that no information that would allow the hackers to seize control of users' accounts was pilfered during attack.

Even so, the company is urging users to change their passwords as a precautionary measure.

According to reports, Yahoo Japan has around 200 million members, which means the attack could have affected around 10 per cent of the country's total user base.

Ross Brewer, managing director and vice president for international markets at security vendor LogRhythm, said Yahoo should be commended for coming clean about the attack.

"[Yahoo] should also be commended for providing its members with actionable advice on how to stop hackers from compromising their individual accounts," said Brewer.

"However, in the aftermath of any breach, it's also absolutely vital to investigate how the attackers managed to get in, and then use this intelligence to beef up security defences in the future."

Internet giant Yahoo has confirmed plans to buy social blogging site Tumblr for around $1.1 billion.

The site, which is reported to have more than 300 million monthly unique visitors, will continue to operate as a standalone entity and David Karp will stay on as its chief executive.

"The product, service and brand will continue to be defined and developed separately with the same Tumblr irreverence, wit and commitment to empower creators," said Yahoo in a statement.

Reports linking the two firms have begun to circulate in recent days, but the deal was only confirmed earlier this afternoon.

Yahoo has carried out nearly a dozen acquisitions since handing over the company reins to former Google exec Marissa Mayer last July.

Further to this, since joining the company as CEO, Mayer has also taken to steps to wind down a series of long standing Yahoo services, as reported by IT Pro here .

"Tumblr's tremendous popularity and engagement among creators, curators and audiences of all ages brings a significant new community of users to the Yahoo network," the statement continued.

"The combination of Tumblr and Yahoo could grow Yahoo's audience by 50 per cent to more than a billion monthly visitors, and could grow traffic by approximately 20 per cent."

In a blog post, published via Tumblr, Mayer said the site's users will be able to draw on Yahoo's search capabilities to share their content across the web.

"In terms of working together, Tumblr can deploy Yahoo's personalisation technology and search infrastructure to help its users discover creators, bloggers and the content they'll love," wrote Mayer.

"In turn, Tumblr brings 50 billion blog posts (and 75 million more arriving each day) to Yahoo's media network and search experiences," she added.

She also assured Tumblr users that the company has no plans to "screw it up".

The deal is expected to closed during the second half of the year and is subject to customary closing conditions.