200 million Yahoo account details 'published on dark web'

Email details for sale on the dark web for just £1,400, hacker says

Peace, the hacker behind the Myspace and LinkedIn data dumps, has put what they claim are the details of 200 million Yahoo accounts up for sale on the dark web.

The asking price for the logs, which according to published sample include usernames, hashed passwords, dates of birth and in some cases backup email addresses, is three bitcoins, which equates to 1,373 at the time of writing.

Peace was also behind the sale of 117 million LinkedIn and 360 millionMySpace details earlier this year, which appeared on the same dark net site as this current batch. It is unclear, however, whether the person hacked the database themselves or has simply collated details that were already circulating.

In the 'advert' for the haul, Peace says the credentials are from "2012 most likely", indicating they do not know themselves quite what it contains in terms of age. This could mean a number of the accounts are defunct.

In a statement provided to IT Pro, Yahoo neither confirmed nor denied the validity of the alleged stolen credentials, saying: "We are aware of a claim. We are committed to protecting the security of our users' information and we take any such claim very seriously. Our security team is working to determine the facts. Yahoo works hard to keep our users safe, and we always encourage our users to create strong passwords, or give up passwords altogether by using Yahoo Account Key, and use different passwords for different platforms."

This is the second time what is claimed to be stolen Yahoo credentials have gone on sale on the dark net this year. In May, the details of tens-of-millions of Yahoo, Gmail and Hotmail accounts were discovered by Hold Security on a Russian dark net site.

The accounts "were put on sale for 50 roubles - or just over 50p",  according to Express, the online arm of the Daily Express and Sunday Express. The website did not make it clear whether this referred to 50 roubles for each account, or 50 roubles for the entire haul.

In July, Verizon announced it is to acquire Yahoo's advertising and search business for $5 billion. However, the deal does not include its email service. Yahoo intends to kill off passwords, replacing them with a new account login process that sends users a push notification to their smartphone whenever they want to log into their accounts.

This article was originally published on 2 August 2016 at 11.00am and has since been updated to include comments from Yahoo.

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

What is hacktivism?
hacking

What is hacktivism?

22 Apr 2021
HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Russia launched over a million cyber attacks in three months
hacking

Russia launched over a million cyber attacks in three months

13 Apr 2021
Hackers leak data from dark web marketplace
cyber security

Hackers leak data from dark web marketplace

9 Apr 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
REvil threatens to release Apple’s hardware schematics
ransomware

REvil threatens to release Apple’s hardware schematics

21 Apr 2021