Yahoo users might want to reset their passwords. A hacker claims to have stolen the login information for 200 million Yahoo accounts and is selling them on the black market.
The stolen records are up for sale on TheRealDeal, a darknet marketplace that offers illegal goods. For 3 bitcoins, or US$1,824, anyone can buy them.
The hacker, known as peace_of_mind, has claimed to have previously sold login credentials for LinkedIn and Tumblr users.
In a brief message, peace_of_mind said the Yahoo database came from a Russian group that breached LinkedIn and Tumblr, in addition to MySpace.
In the case of the Yahoo accounts, the database “most likely” comes from 2012, the hacker said. Copies of the stolen Yahoo database have already been bought, peace_of_mind added.
On Monday, Yahoo said it was “aware” that the stolen database was on sale, but it neither confirmed nor denied that the records were real.
“Our security team is working to determine the facts,” the company said in an email.
Back in 2012, Yahoo reported a breach, but of only 450,000 accounts. A hacking group called D33ds Company had claimed responsibility, but Yahoo said that most of the stolen passwords were invalid.
It’s unclear if that hack is connected with this sale of 200 million accounts. Other security researchers have also noticed a Russian hacker known as “the Collector” selling tens of millions of email logins from Yahoo, Gmail and Hotmail.
Peace_of_mind has posted a sample of the stolen Yahoo database, which includes user email addresses, along with passwords that have been hashed using the MD5 algorithm.
Those passwords could easily be cracked using a MD5 decrypter available online. The database also contains backup email addresses, as well as the users’ birth dates.
IDG News Service tried several email addresses from the stolen records and noticed that Yahoo’s login page recognized them and then asked for a password. However, other emails addresses were no longer valid.
Although Yahoo hasn’t confirmed the breach, users should still change their passwords, said Adam Levin, chairman of security firm IDT911, in an email.
In addition, users should make sure they aren’t using the same passwords across Internet accounts, he added.