Yahoo confirms theft of 450K unencrypted passwords

12.07.2012
Yahoo today confirmed that 450,000 unencrypted usernames and passwords were stolen Wednesday from one of its services, although it downplayed the threat.

"We confirm that an older file from Yahoo! Contributor Network, previously Associated Content, containing approximately 450,000 Yahoo! and other company usernames and passwords was compromised yesterday, July 11," Yahoo said in a statement forwarded by a company spokeswoman Thursday.

"Of these, less than 5% of the Yahoo! accounts had valid passwords," the company maintained. However, it did not say what percentage of the remaining accounts, which included over 100,000 Gmail addresses and more than 55,000 Hotmail addresses, included valid passwords.

is a platform that lets writers, photographers, and others share content with Yahoo members and earn money based on the traffic it generates. Users who contribute to the network are required to sign in using a Yahoo, Google or Facebook ID.

Yesterday, a hacker group calling itself "the D33Ds Company" claimed to have hacked into a Yahoo database by exploiting an SQL injection vulnerability found on a Yahoo subdomain. The group .

Based on a host name left in the published materials, speculation yesterday focused on Yahoo Voices as the most likely subdomain that was hacked. Yahoo Voices is the portal where uses access the content posted by the Yahoo Contributor Network.