Important Yahoo warning - close down any Yahoo accounts you have NOW!

Yahoo just announced another security breach where a whopping billion accounts were hacked. This is the second time in a matter of months that Yahoo has announced a security breach - what an epic fail! This latest hack is being hailed the largest in history, according to CNBC (source).

The forensic investigation is still going on, but it is highly likely that the bad guys initially got in through a spear phishing attack with a spoofed 'From' address. These types of attacks are hard to spot and employees tend to fall for them. 

At this point, Yahoo has fallen down on security in so many ways that we are now advising all our clients who have an active Yahoo email account, either direct with Yahoo of via a partner like AT&T, get rid of it. And in case you have employees who check their Yahoo account on lunch breaks... it's time to put Yahoo on the block list of your firewall and all filtering software & devices.

Here's some hints and tips for Yahoo account owners....

1. Before you delete the account, get rid of all the folders and only then delete the account and open a free gmail account instead.
2. Check if you have used your Yahoo password in other sites, and change the password and security questions for those accounts. And remember, never reuse your email password (or any other password tied to an account that holds sensitive data about you) at any other site.
3. If you used a mobile phone number in association with your Yahoo account, and you still use that mobile phone number, then SMS phishing (a.k.a. Smishing) is now a distinct possibility, so be very wary of this.

Yahoo raising security concerns for 'recycling" old e-mail addresses.

Yahoo has announced a plan to "recycle" old e-mail addresses, a move meant to free up accounts for folks who want them but that has sparked privacy concerns.

In a blog post, senior vice president Jay Rossiter announced that Yahoo e-mail accounts that have been dormant for more than a year will be reset so that active users can have access to them.

"If you're like me, you want a Yahoo! ID that's short, sweet, and memorable like albert@yahoo.com instead of albert9330399@yahoo.com," he wrote.

 

The one-year period will officially begin July 15, when users can "claim" a dormant account name. They'll find out in mid-August if they got the account they wanted.

 

It's clearly an effort by Yahoo, which has been working to redefine and rejuvenate itself under new CEO Marissa Mayer, to re-engage older users and reward active ones. But it has security experts nervous.

 

Security analyst Graham Cluley doesn't mince words.

 

"In short: as an idea it sucks, and it shows Yahoo's lack of respect to customers who created accounts with them in years gone by," Cluley wrote Wednesday.

 

Cluley lists several scenarios where the plan could backfire. They include situations in which a user has another primary e-mail account, but has given their Yahoo address as a backup in case of security situations, lost passwords and the like.

 

He said the move appears to be "an underhanded way to get people to re-engage with the site" and that people who may not actively use their Yahoo mail, but use it to store old messages and other documents, could lose them without ever realizing it.

 

Mat Honan of CNN content partner Wired, himself the recent victim of a high-profile hack, called the move "a spectacularly bad idea."

 

In the wake of such complaints, Yahoo released a followup statement saying it's sure the transition can be made without compromising security.

 

"We're committed and confident in our ability to do this in a way that's safe, secure and protects our users' data," the company said.

 

The vast majority of inactive Yahoo IDs don't have a mailbox associated with them, the company said, and any personal data associated with the accounts will be deleted.

 

During a 30-day deactivation period, bounce-back e-mails will alert senders that the deactivated account no longer exists and Yahoo will unsubscribe those accounts from newsletters, commercial e-mail alerts and the like.

 

Businesses, financial institutions, social networks and other e-mail providers will be sent notifications about e-mail addresses that have been deactivated.

 

Source: CNN