Computer hackers swiped personal information from at least 500 million Yahoo accounts in what is believed to be the biggest digital break-in at an email provider.
The massive security breakdown poses new headaches for Yahoo CEO Marissa Mayer as she scrambles to close a $4.8 billion ($NZ6.5 billion) sale to Verizon Communication.
A Yahoo sign at the company's headquarters in Sunnyvale, California.
Source: Associated Press
The breach dates back to late 2014, raising questions about the checks and balances within Yahoo - a fallen internet star that has been laying off staff to counter a steep drop in revenue during the past eight years.
At the time of the break-in, Yahoo's security team was led by Alex Stamos, a respected industry executive who left last year to take a similar job at Facebook.
Yahoo didn't explain what took so long to uncover a breach that it blamed on a "state-sponsored actor" - parlance for a hacker working on behalf of a foreign government.
Most accounts ever stolen
"This is a pretty big deal that is probably going to cost them tens of millions of dollars," predicted Avivah Litan, a computer security analyst for Gartner Inc.
"Regulators and lawyers are going to have a field day with this one."
Yahoo CEO Marissa Mayer.
Source: Associated Press
Litan described it as the most accounts stolen from a single email provider.
The stolen data includes users' names, email addresses, telephone numbers, birth dates, scrambled passwords, and the security questions — and answers — used to verify an accountholder's identity.
Yahoois recommending that users change their passwords if they haven't done so since 2014.
The company said the attacker didn't get any information about its users' bank accounts or credit and debit cards.
The Verizon impact
News of the security lapse could cause some people to have second thoughts about relying on Yahoo's services, raising a prickly issue for the company as it tries to sell its digital operations to Verizon Communications.
That deal, announced two months ago, isn't supposed to close until early next year.
That leaves Verizon with wiggle room to renegotiate the purchase price or even back out if it believes the security breach will harm Yahoo's business.
Delay of acquisition?
At the very least, Verizon is going to need more time to assess what it will be getting into if it proceeds with its plans to take over Yahoo, said Scott Vernick, an attorney specialising in data security for the law firm Fox Rothschild.
"This is going to slow things down. There is going to be a lot of blood, sweat and tears shed on this" Vernick said.
"A buyer needs to understand the cybersecurity strengths and weaknesses of its target these days."
Investors evidently aren't nervous about the Verizon deal unraveling yet. Yahoo's stock added a penny Thursday to close at $US44.17.