Big Email Hack Doesn't Exactly Send The Message Yahoo Needed

US officials are also now investigating and Verizon - in the process of acquiring Yahoo - issued a terse statement but declined to say if this would influence the sale.

But it's worse for Yahoo's users.

So perhaps the better question might be - why didn't Yahoo warn its account holders of the possibility of an attack and urge them to change their passwords regardless?

Cyber thieves may have stolen names, email addresses, telephone numbers, dates of birth and encrypted passwords, the company said.

The data breach poses new headaches for Yahoo CEO Marissa Mayer as she tries to close a $4.8bn sale to Verizon Communication.

It says this is particularly important if you haven't changed your Yahoo password since 2014.

In a September 9 regulatory filing with the Securities and Exchange Commission, Yahoo stated it did not have knowledge of "any incidents of, or third party claims alleging. unauthorized access" of personal data of its customers that could have a material adverse effect on Verizon's acquisition.

It is possible that things have taken this long because Yahoo has performed the necessary due diligence and crossed all the Ts and dotted all the exclamation marks before actually coming forward and making itself look like a responsible provider.

Although the public has become habituated to news about data breaches, this news may erode confidence in the online ecosystem, according to Galloway. Verizon said in a statement it was made aware of the breach within the last two days and had limited information about the matter. General signs that an account has been hacked, according to the Yahoo help page, can include account information that is changed in some way without the user's knowledge, spam emails being sent to others from the user's email account, or unrecognized login locations listed on the user's recent activity page (instructions for how to check that can be found here).

Echoing the confusion of many Yahoo users about the ramifications of the data breach, he added: "Not being a hacker, I don't know what their capabilities are".

"Five hundred of the Fortune 500 have been hacked", he said.

It's not clear exactly how numerous 500 million passwords were not hashed with Bcrypt, and even 5 percent would still amount to 25 million crackable passwords.

An ex-Yahoo staffer told Reuters the questions were left unencrypted to make it easier to weed out fake accounts created by spambots, which often reuse answers to standard personal questions.

Instructions on how to enable two-step authentication in Yahoo are on its website.

Despite the size of the incursion, which involved 500 million accounts, Robert Peck of SunTrust wrote Thursday that the deal would not likely trip the "material adverse effect" clause in the Verizon transaction, a customary provision that outlines when a buyer can back out of a deal.

However, Flickr users are definitely affected, as users of the photo-collection site much use Yahoo passwords to log in.

Naturally, if you're one of the half billion affected Yahoo users, you're going to need to take some action.

Customers of Yahoo meanwhile will be less immediately concerned about the way in which news of the hack was revealed than by the practical consequences.