Yahoo just announced that a hacker accessed data on 500 million Yahoo user accounts in 2014. Read the announcement from Yahoo here. The data includes account holder names, email addresses, encrypted passwords, dates of birth, telephone numbers and, in some cases, security questions and answers.
Based on the data exposed, we suggest the following for Yahoo account holders:
- Know that you may be prompted by Yahoo to change your password when you try to login to your account. We recommend that you change your Yahoo account password even if Yahoo doesn't prompt you to do so.
- Choose new security questions and answers for your Yahoo account and any other accounts on which you used the same or similar questions/answers.
- Consider using Yahoo Account Key instead of a password. Click Set Up Yahoo Account Key to Stop Using Passwords for details.
- If your Yahoo account included a backup email address and you used the same password on it as you did your Yahoo account, then change the password for the backup email account as well and use a different password.
- Be aware that scammers can use this type of data to "phish" for more data. See the Investigator Tips from this month's IDShield member newsletter for more on these types of scams: Investigator Tips: Beware of "-ishing".
- Click here to see the text of the email that Yahoo is sending to users.
- Be wary if you get odd email messages from a friend with a Yahoo email account as it might be that their account was taken over by a scammer.
- Be wary of email even if it looks legitimate. Scammers can copy logos and mask the sender's address to appear to be from a trusted person or business. Your spam filter may not catch every fraudulent email sent to your address.
- Think about what you are asked for before providing your sensitive personal information when responding to an email or clicking on a link in an email.
- Yahoo is not going to call you. Understand that caller id can be masked to appear to be a call from someone or some business familiar to you.