Yahoo Aware Hacker Is Advertising 200 Million Accounts on Dark Web

A notorious cybercriminal is advertising 200 million of alleged Yahoo user credentials on the dark web, and the company has said it is aware of the hackers claims, but has not confirmed nor denied the legitimacy of the data.

On Monday, the hacker known as Peace, who has previously sold dumps of Myspace and LinkedIn, listed supposed credentials of Yahoo users on The Real Deal marketplace. Peace told Motherboard that he has been trading the data privately for some time, but only now decided to sell it openly.

We are aware of a claim, a Yahoo spokesperson told Motherboard in an email, before the data was made public. The company did not deny that the customer details were Yahoo users, despite being asked if it corresponded to the companys own records.

We are committed to protecting the security of our users information and we take any such claim very seriously. Our security team is working to determine the facts. Yahoo works hard to keep our users safe, and we always encourage our users to create strong passwords, or give up passwords altogether by using Yahoo Account Key, and use different passwords for different platforms.

According to a sample of the data, it contains usernames, hashed passwords (created with md5 algorithm), dates of birth, and in some cases back-up email addresses. The data is being sold for 3 bitcoins, or around $1,860, and supposedly contains 200 million records from 2012 most likely, according to Peace. Until Yahoo confirms a breach, however, or the full dataset is released for verification, it is possible that the data is collated and repackaged from other major data leaks.

Peace told Motherboard, well fuck them they dont want to confirm well better for me they dont do password reset. Many companies issue password resets to accounts affected by data breaches, or even preemptively in a case like this in which the provenance of leaked data is not entirely clear.

Motherboard obtained a very small sample of the data—only 5000 records—before it was publicly listed, and found that most of the two dozen Yahoo usernames tested by Motherboard did correspond to actual accounts on the service. (This was done by going to the login section of Yahoo, entering the email address, and clicking next; when the email address wasnt recognised, it was not possible to continue.)

However, when Motherboard attempted to contact over 100 of the addresses in the sample set, many returned as undeliverable. This account has been disabled or discontinued, read one autoresponse to many of the emails that failed to deliver properly, while others read This user doesnt have a yahoo.com account.