Yahoo Notifying People About 'Forged Cookie' Attacks

Heads up, Yahoo users: a new breach notification warning may be on the way.

Yahoo is in the process of notifying individuals affected by a previously announced hack involving forged cookies, which allowed an intruder to access people's accounts without entering a password.

Yahoo in December said its outside forensic experts were investigating a forged cookie attack, which occurred between 2015 and 2016. The investigation connected some of that activity to the state-sponsored actor behind the 2014 theft of at least 500 million Yahoo user accounts disclosed in September.

Today, a Yahoo spokesperson told PCMag that investigators have "identified user accounts for which we believe forged cookies were taken or used." The company is now working to notify all potentially affected account holders. Yahoo declined to specify how many people it believes were affected.

Some users have posted on Twitter screenshots of the letter they received from Yahoo about the forged cookie attack.

Hopefully the cookie was forged by a state known for such delicacies. #yahoo #security #baking pic.twitter.com/7gCeEd3Y51 — Joshua B. Plotkin (@jplotkin) February 15, 2017

"We are writing to inform you about a data security issue that involves your Yahoo account," the letter begins. It goes on to say that "a forged cookie may have been used in 2015 or 2016 to access your account."

Yahoo said it has invalidated the forged cookies so they can't be used again.

The news comes after Yahoo in December also disclosed a separate hack which occurred in August 2013 that affected more than one billion accounts. That incident compromised names, email addresses, telephone numbers, birthdates, passwords, and security questions and answers, according to Bob Lord, Yahoo's chief information security officer. It might also put Yahoo's Verizon deal in jeopardy, according to reports.

About Our Expert

Angela Moscaritolo

Managing Editor, Consumer Electronics

My Experience

I'm PCMag's managing editor for consumer electronics, overseeing an experienced team of analysts covering smart home, home entertainment, wearables, fitness and health tech, and various other product categories. I have been with PCMag for more than 10 years, and in that time have written more than 6,000 articles and reviews for the site. I previously served as an analyst focused on smart home and wearable devices, and before that I was a reporter covering consumer tech news. I'm also a yoga instructor, and have been actively teaching group and private classes for nearly a decade.

Prior to joining PCMag, I was a reporter for SC Magazine, focusing on hackers and computer security. I earned a BS in journalism from West Virginia University, and started my career writing for newspapers in New Jersey, Pennsylvania, and West Virginia.

The Technology I Use

My little Florida beach bungalow is brimming with smart home tech. I have a smart speaker or display in every room, allowing me to control other connected devices by voice. The Nest Hub on my bedside table lets me set wake-up alarms, control my smart light bulbs, and set the temperature on my smart thermostat. I use the Amazon Echo Show 8 on my kitchen counter to browse recipes, reorder protein powder, check the weather, and watch the news while I do dishes.

Because I suffer from allergies, air purifiers are essential. My favorite model is the Dyson Purifier Cool TP07, which doubles as a fan and continuously sends indoor pollution data to its companion mobile app.

My pitbull Bradley sheds, so a good robot vacuum is a must. I currently use a premium Ecovacs Deebot that can both vacuum and mop, empty its own dustbin, and wash its own mop cloth.

For fitness, I like to mix up my routine with cycling, indoor rowing, running, and strength training in addition to yoga. I take classes on the Tonal 2 smart strength training machine, I row indoors on an Aviron machine, and track my beach runs with an Apple Watch while listening to music on my Apple AirPods Pro. On the weekends, I love riding e-bikes like the rugged, beach-friendly Aventon Aventure for fun and fitness.

My job involves a lot of virtual meetings, so a quality webcam, microphone, and ring light are important. I use the Jabra PanaCast 20 webcam, the Elgato Wave: 3 microphone, and a Yesker tripod ring light.

As for my preferred phone platform, I'm an iPhone person, but I've also extensively used Android for product testing.

Read the latest from Angela Moscaritolo

Read full bio