Menu
200 million Yahoo accounts may be up for sale on the black market

200 million Yahoo accounts may be up for sale on the black market

The hacker said the Yahoo database came from a Russian group who also breached LinkedIn and Myspace.

Yahoo users might want to reset their passwords. A hacker claims to have stolen the login information for 200 million Yahoo accounts and is selling them on the black market.

The stolen records are up for sale on TheRealDeal, a darknet marketplace that offers illegal goods. For 3 bitcoins, or US$1,824, anyone can buy them.

The hacker, known as peace_of_mind, has claimed to have previously sold login credentials for LinkedIn and Tumblr users.

In a brief message, peace_of_mind said the Yahoo database came from a Russian group that breached LinkedIn and Tumblr, in addition to MySpace.

In the case of the Yahoo accounts, the database “most likely” comes from 2012, the hacker said. Copies of the stolen Yahoo database have already been bought, peace_of_mind added.

On Monday, Yahoo said it was “aware” that the stolen database was on sale, but it neither confirmed nor denied that the records were real.

“Our security team is working to determine the facts,” the company said in an email.

Back in 2012, Yahoo reported a breach, but of only 450,000 accounts. A hacking group called D33ds Company had claimed responsibility, but Yahoo said that most of the stolen passwords were invalid.

It’s unclear if that hack is connected with this sale of 200 million accounts. Other security researchers have also noticed a Russian hacker known as "the Collector" selling tens of millions of email logins from Yahoo, Gmail and Hotmail.

Peace_of_mind has posted a sample of the stolen Yahoo database, which includes user email addresses, along with passwords that have been hashed using the MD5 algorithm.

Those passwords could easily be cracked using a MD5 decrypter available online. The database also contains backup email addresses, as well as the users' birth dates.

IDG News Service tried several email addresses from the stolen records and noticed that Yahoo’s login page recognized them and then asked for a password. However, other emails addresses were no longer valid.

Although Yahoo hasn’t confirmed the breach, users should still change their passwords, said Adam Levin, chairman of security firm IDT911, in an email.

In addition, users should make sure they aren’t using the same passwords across Internet accounts, he added.


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Featured

Slideshows

Bumper channel crowd kicks off first After Hours of 2018

Bumper channel crowd kicks off first After Hours of 2018

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Jefferson in Auckland to kick-start 2018. Photos by Gino Demeer.

Bumper channel crowd kicks off first After Hours of 2018
Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Show Comments