The 2014 Yahoo intrusion compromises the information of at least 500 million accounts. The 2017 US dossier describes a case of espionage and crime, rather than a simple file resold after a digital burglary.
Attackers get information from the user base and internal operating elements. According to the prosecution, these elements can be used to manufacture authentication cookies. A cookie is a proof of session presented to the service; if it is convincingly forged, the system may believe that it recognizes a legitimate user.
The question is not always to find the exact password of each person. An attack can target other means by which the service trusts. Some people are selected to access their messages and contacts, beyond just massive data theft.
The disclosure of the compromise leads to an investigation, access renewals and the invalidation of the authentication means concerned. Repairs should be made to the ability to make or use these passes, not just the habits of account holders.
US authorities accuse two Russian FSB members and criminal accomplices. Not everyone has the same role. The existence of charges against a group does not transform each recipient of a fraudulent message into a victim of the same individual actor.
Finally, we must distinguish this incident from that of 2013, revealed separately and associated with a larger balance sheet. Adding accounts of multiple intrusions indiscriminately would give an impression of misleading accuracy. This story is about the 2014 file and its system of forged passes.
What we know
2014 scope: at least 500 million accounts; separate from 2013 incident. Accusations dated 2017, no affirmation of a conviction of all defendants.
To go to the source
References consulted on 30 October 2026. Linked pages may be in another language.
Signaler une erreur ou apporter une précision
