The Yahoo breach, disclosed in September 2016, remains one of the largest data compromises in history, affecting over three billion accounts. The incident was not a single event but a series of intrusions dating back to 2013. It exposed fundamental failures in password storage, detection, and timely disclosure.
1. The Attack Vector and Scope
Attackers leveraged forged cookies—signed session tokens that allowed access to accounts without a password—alongside stolen credentials. The cookie-forgery technique highlighted how trust in authentication artifacts can be exploited when the underlying signing keys are compromised. The true scope, later revised to 3 billion accounts, was vastly underestimated during initial disclosure.
2. Password Storage Failures
The compromised credential database used legacy hashing, specifically MD5, often unsalted. MD5 is cryptographically broken and trivially brute-forced at scale. The absence of per-user salts allowed massively parallel offline cracking. This case became the canonical example of why modern password storage mandates adaptive, salted one-way functions such as bcrypt or Argon2.
3. Detection and Response Gaps
The intrusion persisted for years without detection, reflecting weak network monitoring and log analysis. Attackers established long-term persistence and were able to move laterally and access the credential store. The delayed disclosure—years after the initial compromise—compounded the risk to users and damaged trust.
4. Prevention and Modern Controls
Preventing a similar breach requires strong password hashing with per-user salts, robust session management with key rotation, comprehensive telemetry and anomaly detection, and rapid incident disclosure. Enabling multi-factor authentication and enforcing credential rotation for affected users are essential post-breach controls.
The Yahoo breach is a stark lesson in the cost of inadequate password security and delayed response. Modern defense must prioritize cryptographic strength, detection capability, and the discipline of timely transparency.
