Yahoo 2013-2014 Data Breach

Critical Severity 3 billion records affected
CompanyYahoo
Breach DateAugust 1, 2013
Disclosure DateSeptember 22, 2016
Records Affected3 billion

The Yahoo data breaches of 2013-2014 represent the largest data breach in history, ultimately affecting all 3 billion Yahoo user accounts.

What Happened

Yahoo experienced two major breaches. The 2014 breach exposed 500 million accounts, while the 2013 breach—initially reported as affecting 1 billion accounts—was later revealed to have compromised all 3 billion Yahoo accounts.

State-sponsored hackers were believed responsible for the 2014 breach, while the 2013 breach was attributed to an unknown attacker. Yahoo didn't disclose the breaches until 2016, years after they occurred.

What Data Was Exposed

  • Names
  • Email addresses
  • Phone numbers
  • Birth dates
  • Hashed passwords (MD5, easily crackable)
  • Security questions and answers

Who Is Affected

All Yahoo account holders, including users of Yahoo Mail, Flickr, Tumblr, and fantasy sports.

How to Check If You Were Affected

If you had a Yahoo account before 2017, assume your data was exposed.

What You Should Do Now

  1. Change your Yahoo password immediately
  2. Update security questions - don't reuse answers elsewhere
  3. Enable two-factor authentication
  4. Change passwords on other sites where you used the same credentials
  5. Be alert for phishing using your exposed information

Last updated: January 13, 2026