Yahoo Data Exposure: Millions of Technical Identifiers Leaked in Privacy Framework Breach A recent security incident has exposed millions of technical identifiers linked to Yahoo users, raising concerns over data privacy and compliance with industry standards. The breach involves 249 unique identifiers tied to the IAB Europe Transparency and Consent Framework (TCF), a widely used system for managing user consent in digital advertising. The leaked data includes browser cookies, device IDs, IP addresses, and hashed or encrypted email addresses, which can be used to track users across platforms. While Yahoo collects this information for analytics, ad personalization, audience measurement, and service development, the exposure highlights vulnerabilities in how such identifiers are stored and shared under the TCF. Yahoo’s privacy policies state that these identifiers are used to authenticate users, enforce security measures, and prevent abuse, but the incident underscores the risks of aggregating technical data even when anonymized. The company allows users to adjust privacy settings via "Privacy & Cookie Settings" or "Privacy Dashboard" links on its sites and apps, though the breach suggests gaps in safeguarding these identifiers. The incident serves as a reminder of the broad scope of technical identifiers in digital tracking and their role in enabling cross-site profiling, even when direct personal data is not explicitly exposed. No timeline for the breach was provided, but the disclosure aligns with growing scrutiny over ad-tech transparency and third-party data-sharing practices.

Massive Password Breaches in 2024–2025: What You Need to Know In 2025, cybersecurity researchers uncovered two of the largest credential leaks in history: a 16 billion-password compilation an aggregation of thousands of breaches over years and an 184 million-record database sourced from infostealer malware, containing active logins for platforms like Google, Apple, Microsoft, and Facebook. These incidents are part of an accelerating trend: password breaches are no longer isolated events but a persistent, industrial-scale threat. ### How Password Breaches Happen Attackers exploit vulnerabilities, misconfigured servers, or phishing attacks to steal credential databases from platforms. Once exfiltrated, the data is traded on dark web forums, packaged into "combo lists," and used in credential-stuffing attacks automated attempts to log into other accounts using the same stolen credentials. By the time a breach is publicly disclosed (often months later), the credentials may have already been circulating for weeks. ### Why Password Breaches Are Uniquely Dangerous Unlike general data breaches (which may expose names or payment details), password breaches give attackers direct access to accounts. Weak or reused passwords amplify the risk: a single leaked credential can compromise multiple accounts if reused. According to Verizon’s Data Breach Investigations Report, stolen credentials are the leading cause of hacking-related breaches, responsible for incidents like the Colonial Pipeline attack. ### Major Breaches in Recent Years - 2025: 16B-password compilation (multi-source aggregation); 184M-record infostealer dump. - 2024: Ticketmaster (560M records), Snowflake-linked breaches (AT&T, Santander), alleged Oracle Cloud compromise. - 2022: LastPass (encrypted vaults + unencrypted metadata stolen). - 2013–2016: Yahoo (3B accounts), Adobe (153M), LinkedIn (117M). ### How Platforms Detect Breached Passwords Google, Apple, Chrome, and Safari now include built-in breach monitoring: - Google Password Checkup: Cross-references saved credentials against a database of 4B+ compromised passwords. - Apple’s Password Monitor: Flags breached passwords in iCloud Keychain using privacy-preserving hashing. - Firefox Monitor/Have I Been Pwned (HIBP): Public tools to check email addresses against breach datasets. ### What to Do If Your Password Is Breached 1. Change the flagged password immediately and any other accounts using it. 2. Prioritize high-risk accounts (email, financial, healthcare). 3. Use a password manager (Bitwarden, 1Password, Keeper) to generate and store unique passwords. 4. Enable two-factor authentication (2FA) on critical accounts. ### Dark Web Monitoring: The Next Layer of Defense Standard tools (HIBP, Google Checkup) rely on publicly disclosed breaches, which can lag behind criminal activity. Dark web monitoring scans private forums, infostealer logs, and marketplaces to detect stolen credentials before they appear in public databases, narrowing the window for attackers to exploit them. The scale of credential exposure in 2024–2025 underscores a grim reality: most users have had passwords leaked at least once. The question is no longer if but how many times and whether proactive measures are in place to limit the damage.

Greatness Phishing-as-a-Service Expands Scope, Exploits Safe Sender Misconfigurations for Persistent M365 Access A sophisticated phishing-as-a-service (PhaaS) platform called Greatness is enabling threat actors to maintain multi-factor authentication (MFA)-approved access to Microsoft 365 tenants for over two weeks after the initial compromise primarily through stolen authentication tokens rather than password theft. First documented by Cisco Talos in May 2023, the platform has since expanded its targeting beyond Microsoft 365 to include iCloud, Yahoo, and Google Workspace, while remaining focused on enterprise M365 environments. ### How Greatness Operates Greatness is a fully monetized service, available via Telegram through a bot and a public channel with 3,220 subscribers, offering a $289/month subscription undercutting competitors like Forg365 ($400/month). Operators register via the bot, receive trial licenses, and are provisioned with phishing infrastructure using api-[token].[base-domain] conventions. The platform provides a web-based "O365 Panel" that tracks campaign metrics, including: - Total cookies and accounts compromised - Visit counts and geospatial victim mapping - License days remaining - Blocked bots - 11+ downloadable lure templates (voicemail, OneDrive, QR codes, Windows Explorer themes) ### Exploiting Trust: The RingCentral Campaign A recent campaign targeted a RingCentral customer protected by ZeroBEC, using spoofed voicemail lures sent from service@ringcentral[.]com via IONOS infrastructure. Despite failing SPF, DKIM, and DMARC checks, the emails bypassed security due to misconfigured domain-based safe sender exclusions a setting that trusted any email claiming to be from ringcentral[.]com, regardless of authentication. Attackers weaponized this trust by adding a fraudulent banner: > "This sender has been verified by [organization].com safe senders list" The strategic choice of RingCentral is notable it is widely deployed, commonly whitelisted, and recently suffered a ransomware incident, raising concerns about customer data exposure. This tactic extends beyond RingCentral: any breach exposing customer lists could reveal organizations likely to trust vendor domains unconditionally, making them vulnerable to similar attacks. ### Technical Execution: AiTM & Token Persistence Victims clicking the "Open Message" button are routed through a five-stage chain: 1. Legitimate click-tracking service (e.g., searchbriefing[.]com) 2. Anti-analysis redirector (finreportviewersoftware[.]sbs) using hex/ROT13/base64 obfuscation 3. Greatness API endpoint for bot detection 4. Cloudflare Turnstile-style "Security Verification" gate 5. Final AiTM proxy or device code phishing flow The AiTM branch relays live Microsoft sign-ins, capturing MFA-approved tokens, then redirects victims to legitimate sites (e.g., raymondjames[.]com) to avoid suspicion. The device code branch abuses OAuth device authorization, using a DocuSign-themed lure and a JavaScript polling function to interact with the Greatness admin backend (greatwallwebsite[.]blog/admin/apifiles[.]php). ### Infrastructure & Persistence Greatness operates a centralized backend, with tokens issued for one domain (e.g., nawarra[.]top) accepted across others (xdccoc[.]top, onewayoutolook[.]one), proving unified license validation. All phishing domains are Cloudflare-fronted, hosted on PHP 8.2.12 Laravel, with wildcard DNS and consistent JSON error responses upon license expiration. Post-compromise, attackers operationalize stolen tokens via commercial VPN infrastructure, including: - Limestone Networks VPS (38.248.95[.]214, fronted as gen-vpn[.]com) - ExpressVPN, EventVPN/Netshield, and PIA VPN exit nodes - Systematic Microsoft 365 enumeration via Graph API (Outlook, Teams, SharePoint, OneDrive, calendars, contacts, and registered apps) The most alarming finding: tokens remained valid for over two weeks, allowing persistent access even without Conditional Access policies in place. The root cause was a dual failure: 1. Safe sender exclusions that delivered the phish 2. Identity-layer controls that focused on credential rotation rather than token and refresh token revocation ### Detection & Attribution Greatness activity is tracked under the honeystorm tag, with URLQuery documenting over 50 campaigns since April 2026. Security firms like Sekoia provide built-in detection rules, while CISA, Cisco Talos, Hornet Security, Trellix, and HALOCK have published research linking "HoneyStorm" to Greatness. Defenders are advised to monitor for: - Infrastructure fingerprints (e.g., "just a momment" redirectors, PHP 8.2.12 Cloudflare domains) - VPN-hosted proxy IP ranges (e.g., 46.173.240[.]0/24, 158.173.166[.]0/24) - Vendor-based safe sender misconfigurations that bypass authentication checks The platform’s evolution underscores the growing threat of AiTM PhaaS ecosystems, where token replay not password theft drives persistence, making traditional security measures insufficient.

Yahoo and Engadget Exposed in Massive Data Breach Affecting 245 Million Users A recent cybersecurity incident has revealed a significant data exposure involving Yahoo, Engadget, and Yahoo Advertising, impacting an estimated 245 million users under the IAB Europe Transparency and Consent Framework (TCF). The breach stemmed from improper handling of technical identifiers, including browser cookies, device IDs, hashed email addresses, and IP addresses data routinely collected for analytics, targeted advertising, and user authentication. The exposed information, while not directly tied to individual identities in its aggregated form, included precise geolocation data, browsing behavior, and device-specific details (such as OS type and session duration). These identifiers, though anonymized, can be cross-referenced to reconstruct user profiles, posing risks for tracking, phishing, or account takeovers if exploited by malicious actors. The incident highlights vulnerabilities in third-party data-sharing practices, particularly within digital advertising ecosystems. Yahoo’s privacy policies indicate that such data is used to personalize ads, measure engagement, and enhance services, but the exposure underscores the challenges of securing vast repositories of technical identifiers even when compliance frameworks like the TCF are in place. Users were directed to adjust their privacy settings via links to "Privacy & Cookie Settings" or "Privacy Dashboard" on affected platforms, though the breach itself appears to have resulted from systemic data collection rather than a direct cyberattack. The full scope of the exposure and its potential misuse remain under investigation.

Massive Credential Breach Exposes 149 Million Logins in Unsecured Database A security researcher recently uncovered a staggering data exposure involving 149 million usernames and passwords left unprotected on the internet. The database, hosted by a Canadian service provider, was freely accessible via a standard web browser, allowing anyone to search and extract sensitive login details without authentication. The breach remained active for about a month, with new credentials continuously added before the hosting provider took it offline following notification. The compromised data spanned a wide range of platforms, including: - Email services: 48 million Gmail, 4 million Yahoo, and 1.5 million Microsoft Outlook accounts - Social media: 17 million Facebook, 780,000 TikTok, and 100,000 OnlyFans logins - Streaming & entertainment: 3.4 million Netflix subscriptions - Financial services: 420,000 Binance cryptocurrency accounts, along with banking and credit card details - Government & education: 1.4 million .edu domain credentials and other official systems Investigators traced the breach to infostealing malware, which infects devices through phishing, malicious downloads, or compromised websites. The malware logs keystrokes and captures login credentials, funneling them into centralized databases like the one discovered. Each entry included unique identifiers, suggesting the database was designed for large-scale criminal operations, such as account takeovers or ransomware attacks. The implications of this breach are severe, with risks ranging from identity theft and financial fraud to potential espionage via compromised government and academic accounts. The incident reflects a broader trend of unsecured databases and the growing accessibility of cybercrime tools renting infrastructure for such operations can cost as little as $200–$300 per month, enabling even low-skilled threat actors to amass vast troves of data. While no immediate exploits have been confirmed, the exposure underscores persistent vulnerabilities in data security practices. Similar breaches have repeatedly demonstrated how quickly stolen credentials circulate on underground forums, prolonging the threat long after the initial leak. The full impact of this incident may unfold over time as attackers exploit the exposed information.

Major Data Collection Practices Revealed by Leading Digital Publishers A recent disclosure highlights how over 1,000 companies—including 242 participating in the IAB Transparency & Consent Framework (TCF)—collect and process user data across websites and apps. These entities store and access device information (such as cookies) and leverage precise geolocation data, IP addresses, browsing history, and search activity for purposes like analytics, personalized advertising, content measurement, and audience research. The data collection spans multiple platforms, including Yahoo, AOL, Engadget, In The Know, and Makers, and tracks metrics like visitor counts, device types (iOS/Android), browser usage, and session duration. While aggregated and not tied to individual users, the practice raises transparency concerns, particularly given the scale of third-party involvement. Users retain the ability to withdraw consent or adjust preferences via "Privacy & Cookie Settings" or "Privacy Dashboard" links on these platforms. However, the disclosure underscores the extensive reach of data-sharing networks in digital advertising and content delivery, with implications for user privacy and regulatory compliance. The incident reflects broader industry trends in cross-site tracking and targeted advertising, where consent frameworks play a central role in managing data access.

An unauthorised third party gained access to the company's secret code to learn how to fake specific cookies, which allowed the intrusive party to have unrestricted access to almost 32 million user accounts. The compromised information included names, email addresses, telephone numbers, hashed passwords, dates of birth, and, in some cases, encrypted or unencrypted security questions and answers, but payment and bank information remained safe.

Yahoo suffered from a cyber-attack incident that technically tricked cookies into users' logging account passwords. Yahoo investigated the incident and asked those affected by the attack to log into their accounts without passwords.

Hackers breached Yahoo's networks and gained access to one billion user accounts, which included phone numbers, addresses, and easily cracked hashed passwords. The released data also included certain encrypted and cleartext security questions and answers that had also been compromised. The passwords were secured with the easily cracked MD5 hashing method. According to more information about the incident, the hacker sold the enormous data collection on the Dark Web. Unfortunately, the hacker was paid by at least three distinct buyers two of whom were prominent spammers to obtain the complete information, which they most certainly intended to exploit for espionage purposes.

A former Yahoo executive claims that between one billion and three billion user accounts could have been impacted by the Yahoo data hack. The Yahoo data breach, according to the experts from the intelligence firm InfoArmor that looked into the event, is the consequence of a cyberattack carried out by cybercriminals who later sold the Yahoo user accounts to a nation-state actor from Eastern Europe. InfoArmor experts verified that the initial hacker to offer the massive data dump for sale is a threat actor going by the handle tessa88; he served as a go-between for the real criminals. A former Yahoo executive, speaking anonymously, claims that the Yahoo architecture collects all user authentication data into a single database.

The California Office of the Attorney General reported a data breach involving Yahoo! Inc. on September 22, 2016. A copy of user account information, potentially affecting at least 500 million accounts, was stolen in late 2014 by what Yahoo believes to be a state-sponsored actor. The stolen information may have included names, email addresses, telephone numbers, dates of birth, and hashed passwords, but did not include unprotected passwords, payment card data, or bank account information.

Some of the user accounts of Telecom’s YahooXtrahas had their details compromised, following a security breach, which apparently affected non-Telecom customers as well. Apparently, Yahoo acknowledged an email security breach that compromised some YahooXtra email accounts.

The Yahoo mega-breach remains one of the most devastating cybersecurity incidents in history, occurring between 2013 and 2014 but disclosed in 2016. Hackers, linked to a state-sponsored group, compromised all 3 billion Yahoo user accounts, exposing names, email addresses, phone numbers, hashed passwords, and security questions/answers. The breach was executed via spear-phishing emails targeting employees, granting attackers access to Yahoo’s internal systems. The fallout was catastrophic: Verizon lowered its acquisition price of Yahoo by $350 million, and the company faced regulatory fines, lawsuits, and irreparable reputational damage. The stolen data was later found for sale on the dark web, enabling identity theft, fraud, and targeted phishing campaigns against users globally. The breach highlighted Yahoo’s negligent security practices, including failure to encrypt sensitive data adequately and delayed disclosure, which worsened the impact. The incident remains a benchmark for corporate data breach consequences, demonstrating how mass-scale personal data exposure can cripple even a tech giant.

Data Breach Checkers: How They Work and Why They Matter A data breach checker is a tool that scans breach databases, dark web markets, and malware logs to determine whether personal information such as email addresses, passwords, phone numbers, or Social Security numbers (SSNs) has been exposed in a known incident. These tools cross-reference user-provided identifiers (e.g., an email or phone number) against vast datasets of compromised records, revealing exposure events that may have gone unnoticed. ### How Breach Checkers Operate Most breach checkers use a hashing and matching model: a user submits an identifier (e.g., an email), which is hashed for privacy before being compared against a database of known breaches. The quality of results depends on the tool’s data sources. Basic checkers rely on publicly disclosed breaches, while advanced ones monitor dark web markets, criminal forums, paste sites, and infostealer malware logs sources that often reveal exposures before they’re formally reported. Key data sources include: - Publicly disclosed breaches (e.g., Adobe 2013, Yahoo 2013–2014). - Dark web intelligence (automated crawlers tracking criminal marketplaces). - Infostealer logs (credentials harvested by malware from infected devices). ### What Breach Checkers Can (and Can’t) Detect A breach checker can confirm: - Whether an identifier (email, phone, username) appeared in a breach. - The breach’s origin, approximate date, and exposed data categories (e.g., passwords, addresses). However, a clean result doesn’t guarantee safety. There’s always a lag between a breach, its discovery, and its inclusion in monitoring tools. A one-time check reflects only known exposures at that moment not future leaks. ### Why Proactive Checks Matter Breach notifications are slow and unreliable. U.S. laws allow companies 30–90 days to notify affected individuals after discovery, and many breaches are never disclosed at all. By then, stolen data may have circulated on the dark web for months. Proactive checking using tools that monitor real-time sources is the only way to detect exposure early. ### How to Check for Exposure #### Email Addresses The most commonly exposed identifier. Tools like DeXpose’s Email Data Breach Scan or Have I Been Pwned (HIBP) cross-reference emails against breach databases and dark web sources. If a password is exposed, all accounts using it (or variations) should be updated immediately. #### Phone Numbers Harder to track due to inconsistent indexing in breaches. HIBP added phone number checks in 2021, covering datasets like the 2021 Facebook breach (533M records). For broader coverage, dark web monitoring tools scan criminal markets where phone numbers appear. #### Social Security Numbers (SSNs) No legitimate tool stores or searches raw SSNs. Instead, checkers like Pentester’s NPD breach tool (for the 2024 National Public Data breach, 2.9B records) verify exposure by matching name, state, and date of birth against known datasets. Additional protections include: - Credit freezes (prevents new account fraud). - IRS Identity Protection PIN (blocks fraudulent tax filings). #### Dark Web Monitoring Standard search engines can’t access the dark web. Dedicated services (e.g., DeXpose’s Dark Web Report) scan criminal markets, forums, and malware logs, providing source-specific alerts (e.g., whether credentials appeared in a fresh infostealer log vs. an old breach). #### High-Profile Breach Checks - AT&T (2024): Two breaches exposed 73M records (including SSNs) and call/text metadata for nearly all wireless customers. Check via [AT&T’s settlement page](https://www.att.com/breach). - National Public Data (NPD): 2.9B records (names, SSNs, addresses) leaked. Verify exposure at [npd.pentester.com](https://npd.pentester.com). - TransUnion/Experian: Credit-focused breaches may include credit history and personal identifiers. Freeze credit and monitor reports. ### After a Breach: Immediate Actions 1. Identify exposed data (e.g., passwords, SSNs, financial info). 2. Change passwords on the breached account and any others using the same (or similar) credentials. 3. Enable multi-factor authentication (MFA) on critical accounts (email, banking). 4. Freeze credit with all three bureaus if SSNs or financial data were exposed. 5. Monitor continuously one-time checks miss future exposures. ### Limitations of Free Tools While free tools like HIBP or Mozilla Monitor cover historical breaches, they often lack real-time dark web monitoring. Paid services (e.g., DeXpose, Google One Dark Web Report) provide broader coverage, including malware logs and criminal marketplaces. ### Key Takeaways - Breach checkers reveal hidden exposures but can’t guarantee safety. - Email checks are the baseline; phone numbers and SSNs require specialized tools. - Dark web monitoring detects fresh leaks faster than breach notifications. - Credit freezes and MFA are critical defenses after exposure. - Continuous monitoring is essential breaches don’t stop after a single check.

The 25 Most Impactful Cyberattacks in History: A Breakdown of Scale and Consequences Global cybercrime costs are projected to surge from $10.5 trillion in 2025 to $12.2 trillion by 2031, driven by data theft, financial fraud, operational disruptions, and recovery expenses. Cybersecurity Ventures has compiled a list of the 25 most significant cyberattacks in history, ranked by data compromised, financial impact, geopolitical fallout, and attack sophistication demonstrating that scale isn’t measured by a single metric. A nation-crippling fuel shortage and a breach of three billion records can both qualify as "biggest," depending on the damage inflicted. Key Incidents Highlighted: - Yahoo Data Breach (2013–2014): Compromised 3 billion user accounts, one of the largest breaches by volume. - Stuxnet (2010): A state-sponsored cyberweapon targeting Iran’s nuclear facilities, marking a turning point in cyber warfare. - WannaCry (2017): Ransomware that infected 200,000+ systems across 150 countries, disrupting hospitals, businesses, and government agencies. - NotPetya (2017): Initially disguised as ransomware, it caused $10 billion in global damages, crippling shipping, logistics, and pharmaceutical firms. - SolarWinds (2020): A supply chain attack attributed to Russian hackers, infiltrating U.S. government agencies and Fortune 500 companies via compromised software updates. - Colonial Pipeline (2021): A ransomware attack forced the shutdown of a major U.S. fuel pipeline, triggering fuel shortages and panic buying. - OPM Data Breach (2015): Exposed sensitive records of 21.5 million U.S. federal employees, including background check data. - MOVEit Transfer (2023): A zero-day exploit in file-transfer software led to widespread data theft, affecting government agencies, corporations, and universities. - Change Healthcare (2024): A ransomware attack disrupted U.S. healthcare payments, delaying prescriptions and insurance processing nationwide. Emerging Threats: Attackers are increasingly leveraging AI to refine phishing campaigns, generate polymorphic malware, and automate reconnaissance. Meanwhile, quantum computing looms as a future threat, with the potential to break widely used encryption standards. As cyber threats evolve, so too do their methods from early viruses like Melissa (1999) and Code Red (2001) to modern supply chain attacks and AI-driven exploits. The list underscores the persistent and escalating nature of cyber risks across industries and governments.