SUNNYVALE, Calif.—Yahoo has confirmed that information from at least 500 million Yahoo accounts was stolen from the company in 2014, making the hack one of the largest in U.S. history in terms of user accounts.
While the FBI, which is investigating the matter has not shared details on who might behind the attack, reports indicate that that a state-sponsored actor may have been the engineer.
"The account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers," Yahoo said in a statement.
Yahoo is advising its users to change their passwords and security questions and to monitor their accounts for suspicious activity.
Yahoo reported sensitive financial data like bank account numbers and credit card data are not believed to be included in the stolen information. However, many cyber security experts feel as the U.S. migrates to EMV that crooks are turning more toward creating profiles of victims to gain access to financial accounts, using other methods to get at the money than payment cards.
"We take these types of breaches very seriously and will determine how this occurred and who is responsible," the FBI told USA Today.
Reports indicate that signs of trouble emerged in early August, as a hacker using the name "Peace" claimed to be selling data from 200 million Yahoo users online.