500m accounts breached in attack on Yahoo in 2014

San Francisco

YAHOO Inc said that the personal information of at least 500 million users was stolen in an attack on its accounts in 2014, exposing a wide swath of its roughly one billion users ahead of Verizon Communications Inc's planned acquisition of the Web portal's assets.

The attacker was a "state-sponsored actor", and stolen information may include names, e-mail addresses, phone numbers, dates of birth, encrypted passwords and, in some cases, un-encrypted security questions and answers, Yahoo said on Thursday in a statement. The continuing investigation does not indicate theft of payment card data or bank account information, or unprotected passwords, the company said. Affected users are being notified, accounts are being secured, and there is no evidence the attacker is still in Yahoo's network, it also said.