An unspecified number of Yahoo Mail users have had their usernames and passwords compromised, the company announced late Thursday. The hack appears to have taken place via a compromised third party database, and Yahoo has taken the precaution of resetting the passwords of affected users.
"Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts," Yahoo senior VP Jay Rossiter said in a Tumblr post. "The information sought in the attack seems to be names and email addresses from the affected accounts’ most recent sent emails ... we have no evidence that they were obtained directly from Yahoo’s systems."
Rossiter wouldn't say what third-party database contained all the emails. But if your account was one of the ones affected, your password has been reset automatically — and you should be getting an email or text message (if you've set up two-factor authentication) with further details. Yahoo says it's working with law enforcement to find the perpetrators.
This is only the latest in a series of embarrassments for Yahoo services. CEO Marissa Mayer apologized last month for a days-long outage of the Mail service, which for some users was hidden behind erroneous "system down for maintenance" messages. This was followed up by a major Flickr outage.
The company recently rolled out 2048-bit SSL encryption for Yahoo Mail, designed to make the service more secure.