Yahoo is still in the dark about who might have been behind the 2013 data breach that stole information on 3 billion user accounts, according to former company CEO Marissa Mayer.
"To this day, as I understand it, we still have not been able to identify the intrusion that led to that theft," Mayer said during a congressional hearing on Wednesday.
Yahoo and US federal agents have blamed a separate 2014 company data breach involving 500 million accounts on Russian state-sponsored hackers. One of those suspected hackers, Karim Baratov, has even been arrested and extradited to the US.
But details over who pulled off the more serious 2013 hack continue to elude Yahoo, Mayer said during Wednesday's hearing, which was focused on protecting consumers from future data breaches.
The 2013 breach, which likely occurred in August of that year, stole user account data including names, email addresses, telephone numbers, dates of birth, and hashed passwords. That means the perpetrators had three years to dive into Yahoo user accounts, and to any other internet accounts registered with the same usernames and passwords.
Yahoo only learned about the hack last November, when US law enforcement presented the company with the stolen information, Mayer said. "We verified that it came from Yahoo, but we don't exactly understand how the act was perpetrated," she told the committee.
Yahoo alerted the public, and has since doubled the size of its security team. It's also implemented new measures to protect the affected accounts.
Mayer, who left Yahoo after Verizon completed its acquisition of Yahoo in June, apologized for the breaches during the hearing. But she also said the US government has to do more to empower law enforcement to pursue and stop hackers, especially the state-sponsored kind.
"Right now there's just not enough of a disincentive to hack," she said.
To protect yourself from hacks, it's a good idea to never reuse the same password on different internet accounts. Two-factor authentication will also add an extra layer of security. In addition to entering a password during the login process, it forces the account holder to enter a special code that's usually generated from your mobile phone.