The call has gone out to Yahoo Japan’s 200 million users to change their passwords, after the company warned that it suspected hackers had managed to access a file containing 22 million user IDs.
Yahoo Japan says that it detected an attempt to gain unauthorised access to its administrative systems on Thursday at approximately 9pm local time.
Although the information taken from Yahoo Japan’s servers is said not to contain passwords, or other personal identifying information required to hijack an account (such as the answers to secret questions), the site has decided that users should reset their passwords regardless.
In a press statement published on Yahoo Japan’s website, the number one search engine in Japan stressed that it had not confirmed that the data had definitely leaked to the outside world, but that it deeply apologised for any inconvenience caused.
Fingers crossed, only user IDs were exposed during the security breach and nothing more serious. But even user IDs should be private, and kept out of the hands of cybercriminals.
Potentially, online criminals now have a database of 22 million Yahoo Japan email addresses – and there are surely slimebags out there who would get a real kick out of spewing out a spam campaign, sending a phishing attack to Yahoo users, posing as a legitimate email from the company, or launching a targeted malware attack.
Hopefully Yahoo Japan will be investigating how the security breach occurred, and putting strong defences in place to prevent it – or anything worse – happening in future.
4 comments on “22 million user IDs may be in the hands of hackers, after Yahoo Japan security breach”
It would have been reassuring if the “call”, had been pro-actively pushed out to users. I am a yahoo.co.jp user and had it not been for your post I would probably not have found out yet. There has been no mail to users, no announcement on the web mail page and nothing prominent on the www.yahoo.co.jp home page, just a small link down at the bottom of that page.
This is the second announcement of unauthorised access to the site in just over a month.
How is this "unauthorised access" happening?
However it's happening, that's pretty scary stuff. I expected better from Yahoo. I guess I was wrong.
Shouldn’t the US Yahoo have put out a notice like “Yahoo.co.jp is a separate company, so Yahoo.com accounts are NOT affected.”?
AFAIK, yahoo.co.jp and yahoo.com ran on very similar tech stacks at the time (and still do to an extent) and right around this time, yahoo.com was also breached – but we didn’t know about it for 3 years. 3 BILLION users were affected!