AAPL Stock: 117.81 ( -0.22 )

Printed from

Yahoo Voices server hacked, 400,000 passwords leaked

updated 01:56 am EDT, Thu July 12, 2012

No official statement by Yahoo on intrusion

Over 400,000 password and email combinations from a Yahoo Voices-rebranded Associated Content server have been posted onine in an apparent breach of security, according to security analyst Trusted Sec. The passwords are connected to their user-identification email addresses, not just from Yahoo, but also from Gmail, AOL, and more. The crowd-sourced question and answer service Associated Content was purchased by Yahoo in May 2010 and fully integrated into the Yahoo suite of products in December 2011.

The (large) text file was stored on the web server, but was not available at the time of this writing and has likely been pulled as the root domain is still connectible. The hackers responsible for the breach left a comment on the data dump, addressing Yahoo for lax security: "We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat. There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage."

Electronista has contacted Yahoo for comment and will update this story further if warranted. [via Trusted Sec]

by MacNN Staff




  1. taptapas

    Fresh-Faced Recruit

    Joined: 07-11-12

    Security 101 - don't store clear text passwords, hash them with a key and compare hashes. At least then if data is stolen the passwords remain safe. Over the past year or so we've seen many big companies loose data with clear passwords. I'd go as far as saying it should be mandated in law that companies storing third party passwords have to do this. Believing your data won't be compromised is the wrong approach, so design your systems to limit the damage if it is !

  1. lkrupp

    Junior Member

    Joined: 05-13-01

    Mandating security procedures won't work. The only way to get a company's attention is to hit them in the pocketbook. Make them civilly and possibly criminally liable for their customer's privacy and data loss. A few large judgements and suddenly those servers will be impenetrable. The bean counters will see to that right away.

  1. glork

    Fresh-Faced Recruit

    Joined: 07-12-12

    Searchable list of the emails / usernames is here:

  1. Marilisa

    Fresh-Faced Recruit

    Joined: 07-12-12

    Yikes! This is the first I've heard. Anyway to find out if I was affected? Thanks for good reporting. Marilisa

Login Here

Not a member of the MacNN forums? Register now for free.


Network Headlines

Follow us on Facebook


Most Popular


Recent Reviews

Ultimate Ears Megaboom Bluetooth Speaker

Ultimate Ears (now owned by Logitech) has found great success in the marketplace with its "Boom" series of Bluetooth speakers, a mod ...

Kinivo URBN Premium Bluetooth Headphones

We love music, and we're willing to bet that you do, too. If you're like us, you probably spend a good portion of your time wearing ...

Jamstik+ MIDI Controller

For a long time the MIDI world has been dominated by keyboard-inspired controllers. Times are changing however, and we are slowly star ...


Most Commented