FBI investigating newly discovered Yahoo breach of one billion user accounts, White House says

The FBI is investigating the recently disclosed massive 2013 data breach at Yahoo that compromised the personal data of at least one billion user accounts, the White House said on Thursday (15 December). During a daily White House press briefing, spokesman Josh Earnest said he could not address the potential scale of the attack and user data that may have been compromised in the cyberattack.

"There was a previously reported breach that the FBI had previously indicated that they were investigating and they're investigating this situation as well, so I'll let them speak to what they have found over the course of that investigation so far," Earnest said, the Guardian reported.

He added that the FBI would want to make sure that making a public announcement about the perpetrators behind the breach would not affect its investigation prior to doing so.

On Wednesday, Yahoo revealed that it had uncovered yet another cyberattack that occurred in 2013 and affected more than one billion user accounts, making it the biggest-known hack in history.

Yahoo said it "believes an unauthorised third party, in August 2013, stole data associated with more than one billion user accounts" and may have included names, email addresses, hashed passwords and phone numbers. It noted that no bank account information or payment account data was affected in the attack.

The company said it discovered the intrusion during the ongoing investigation of another breach of 500 million accounts that the company previously revealed in September. It added that the 2013 breach "is likely distinct from the incident the company disclosed on September 22, 2016". Yahoo said it was unable to identify the intrusion that led to this breach.

In September, Yahoo said the attack was "state-sponsored" - a claim that many security experts have questioned.

"Yahoo badly screwed up," Bruce Schneier, leading cybersecurity and privacy researcher Bruce Schneier told Reuters. "They weren't taking security seriously and that's now very clear. I would have trouble trusting Yahoo going forward."

Based on the ongoing investigation, Yahoo said it believes the hackers accessed its proprietary code to learn how to forge "cookies", allowing the cybercriminals to access a user's account without a password. It also noted that it has connected some of this activity "to the same state-sponsored actor" believed to be behind the 2014 data breach that was revealed in September.

Telecom giant Verizon, which signed a deal to acquire Yahoo's core business for $4.85bn (£3.9bn) in July, said it will "review the impact of this new development before reaching any final conclusions". Citing an unidentified source familiar with the matter, Bloomberg reports that Verizon may looking for a price cut or a possible exit from the pending deal.

Yahoo said in a statement that it is "confident in Yahoo's value and we continue to work towards integration with Verizon".

"The damage inflicted upon a big business from a well-orchestrated attack can exact costs for decades to come," Brian Laing, VP at security firm Lastline told IBTimes UK. "These costs can range from the hard dollar costs of litigation, paying ransoms, investigations and infrastructure replacement to the soft-but-real losses of escalating customer churn and brand value decline.

"Perhaps a Yahoo-Verizon deal adjustment may stand as a sober reminder how important it is to get a state-of-art cyber defence strategy in place."