The Yahoo suffered from a data breach incident that exposed 500 million user accounts in a data breach dating back to 2014.
The account information includes names, email addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers.
According to the current investigation, unencrypted passwords, credit card numbers, and bank account information were not included in the stolen material; these details are not kept in the system that the inquiry has determined to be compromised.
Yahoo thinks that information linked to at least 500 million user accounts was taken, based on an ongoing investigation; however, no proof of the state-sponsored actor's presence in Yahoo's network has been discovered.
Source: https://securityaffairs.com/51560/data-breach/yahoo-data-breach.html
TPRM report: https://scoringcyber.rankiteo.com/company/yahoo
"id": "yah1045311023",
"linkid": "yahoo",
"type": "Breach",
"date": "09/2016",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': 500000000,
'industry': 'Technology',
'name': 'Yahoo',
'type': 'Company'}],
'data_breach': {'number_of_records_exposed': 500000000,
'personally_identifiable_information': True,
'type_of_data_compromised': ['names',
'email addresses',
'telephone numbers',
'dates of birth',
'hashed passwords',
'encrypted or unencrypted '
'security questions and '
'answers']},
'date_detected': '2014',
'description': 'The Yahoo suffered from a data breach incident that exposed '
'500 million user accounts in a data breach dating back to '
'2014. The account information includes names, email '
'addresses, telephone numbers, dates of birth, hashed '
'passwords and, in some cases, encrypted or unencrypted '
'security questions and answers. Unencrypted passwords, credit '
'card numbers, and bank account information were not included '
'in the stolen material; these details are not kept in the '
'system that the inquiry has determined to be compromised. '
'Yahoo thinks that information linked to at least 500 million '
'user accounts was taken, based on an ongoing investigation; '
"however, no proof of the state-sponsored actor's presence in "
"Yahoo's network has been discovered.",
'impact': {'data_compromised': ['names',
'email addresses',
'telephone numbers',
'dates of birth',
'hashed passwords',
'encrypted or unencrypted security questions '
'and answers']},
'investigation_status': 'Ongoing',
'title': 'Yahoo Data Breach',
'type': 'Data Breach'}