Yahoo Data Breaches: What Was Exposed and What to Do
Yahoo suffered the largest account breaches on record, disclosed years after they happened. Here is what was stolen and what it still means.
By Siddharth ShankarUpdated October 20, 2026Yahoo had two huge breaches. In 2013, all 3 billion accounts were affected, first reported as 1 billion in December 2016 and revised in October 2017. In 2014, over 500 million accounts were hit, disclosed in September 2016. Stolen data included names, emails, phone numbers, birth dates, hashed passwords and some security questions. If you had a Yahoo account then and reused its password or security answers, change them everywhere.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
If you had a Yahoo email or account in the 2010s, you were very probably affected. These breaches are still among the largest ever and show why delayed disclosure is a problem.
The two breaches
According to Wikipedia’s summary of the Yahoo data breaches:
- 2013 breach. It affected all 3 billion accounts. Yahoo disclosed it on December 14, 2016, first as 1 billion accounts, then revised the figure to 3 billion in October 2017.
- 2014 breach. It affected more than 500 million accounts. Yahoo disclosed it on September 22, 2016.
What data was stolen
The stolen data included names, email addresses, telephone numbers, dates of birth and hashed passwords. Most hashes used bcrypt, and some may have used the weaker MD5. Security questions and answers were also taken, and some were stored unencrypted. Security answers are a special problem because they do not change when you change a password.
Forged cookies
In addition, attackers used forged cookies to get into accounts without passwords. The summary says 32 million accounts were accessed this way in 2015 and 2016. A cookie is a small file that keeps you signed in, so forging one lets an attacker act as you.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Charges, fines and settlements
- On March 15, 2017, the FBI charged four men over the 2014 breach. One, Karim Baratov, was sentenced to five years in May 2018.
- The SEC fined Altaba, Yahoo’s successor company, $35 million in 2018.
- A class action settlement of $117.5 million was reached in April 2019.
- The breaches cut the Verizon purchase price by $350 million, to $4.48 billion.
What this means for you today
The passwords are old, but the other data is permanent. Your name, birth date, phone number and security answers do not expire. They can feed targeted phishing and help someone guess answers to account recovery questions. See what each type of breached data means.
What to do
1Check your email
Use our free email check to see whether your address appears in known breaches.
2Change reused passwords
If you reused your Yahoo password anywhere, change it. Use a unique password for each account.
3Change security answers
Replace answers to security questions that you used elsewhere with random ones. Store them in a password manager.
4Turn on two-step verification
Use an authenticator app on your email and key accounts.
5Beware of phishing
Messages that cite your old Yahoo details may be a trick. Go to the website directly.
Security questions: the lasting problem
A password can be changed in minutes. The answer to “What was your first pet’s name?” cannot easily be changed, because it is a fact about your life. If those answers were exposed, anyone who has them could try them on other services that still use the same questions. The fix is to treat security answers like passwords: use random answers and store them in a password manager.
What to do with an old Yahoo address
If you still use it, secure it with a strong unique password and two-step verification. If you do not, consider whether other accounts depend on it for recovery before you close it. Update those first, so you do not lock yourself out.
Delays make breaches worse
Yahoo disclosed the 2013 and 2014 incidents years later. By then criminals had long had the data. That is why it is worth acting on any breach, even an old one. Read should you worry about an old data breach, and compare with the Equifax breach.
Sources
- Wikipedia: Yahoo data breaches (2013 and 2014 breaches, disclosure dates, data types, forged cookies, fines, settlements, charges)
Frequently asked questions
How many Yahoo accounts were breached?
The 2013 breach affected all 3 billion accounts and the 2014 breach affected more than 500 million.
What data was stolen from Yahoo?
Names, emails, phone numbers, dates of birth, hashed passwords and security questions and answers.
When did Yahoo disclose the breaches?
The 2014 breach on September 22, 2016, and the 2013 breach on December 14, 2016, revised to 3 billion in October 2017.
What was the penalty?
The SEC fined Altaba $35 million and a class action settled for $117.5 million.
What should I do if I had a Yahoo account?
Change reused passwords and security answers, and turn on two-step verification.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.