The Yahoo hackers weren't state-sponsored, a security firm says

Elite hackers-for-hire were actually behind the breach, according to InfoArmor

Common criminals, not state-sponsored hackers, carried out the massive 2014 data breach that exposed information about millions of Yahoo user accounts, a security firm said Wednesday.

Yahoo has blamed state actors for the attack, but it was actually elite hackers-for-hire who did it, according to InfoArmor, which claims to have some of the stolen information.   

The independent security firm found the alleged data as part of its investigation into "Group E," a team of five professional hackers believed to be from Eastern Europe.

"According to our information, most of the group's clientele are spammers," said Andrew Komarov, InfoArmor's chief intelligence officer.

InfoArmor's claims dispute Yahoo's contention that a "state-sponsored actor" was behind the data breach, in which information from 500 million user accounts was stolen. Some security experts have been skeptical of Yahoo's claim and wonder why the company isn't offering more details.

The database that InfoArmor has contains only "millions" of accounts, but it includes the users' login IDs, hashed passwords, mobile phone numbers and zip codes, Komarov said.

The security firm says it obtained the data from "operative sources" about a week ago and has verified that the account information is real. Komarov wouldn't say more about how InfoArmor got the data.

Group E has sold the stolen Yahoo database in three private deals, Komarov said. At one point, the Yahoo database was sold for at least $300,000, he said. His firm has been monitoring the group's activities for more than three years. 

InfoArmor also claimed that Group E was behind high-profile breaches at LinkedIn, Dropbox and Tumblr. To sell that information, the team has used other hackers, such as Tessa88 and peace_of_mind, to offer the stolen goods on the digital black market.

"The group is really unique," Komarov said. "They're responsible for the largest hacks in history, in term of users affected."

However, in the case of the Yahoo database, which was taken before Dec. 2014, Group E hasn't made it generally available on the black market, according to Komarov. Group E wants to preserve the database's value. Other hackers have claimed to offer it for sale, but they were actually selling fake information, he said.

Yahoo didn't respond to a request for comment. The company hasn't offered any evidence supporting its claim that state-sponsored hackers carried out the attack.

Other security experts are split over InfoArmor's findings.

Alex Holden, Chief Information Security Officer at Hold Security, said InfoArmor's claims were mostly consistent with what he had found in his own investigations. However, he added, "Right now we do not know with full confidence who was behind the original breach in 2014, and if there was only one breach."

Vitali Kremez, a cybercrime analyst at Flashpoint, is more skeptical of InfoArmor's findings. "They might have jumped the gun too early on this," he said.

He questioned discrepancies between the database that InfoArmor obtained and what Yahoo said was stolen. For example, Yahoo said passwords hashed with the bcrypt algorithm and security questions may have been lifted as part of the breach. The data InfoArmor uncovered only contains passwords hashed with the MD5 algorithm, and no mention of security questions, he said.

"Yahoo said that the stolen passwords used bcrypt. Why would they lie about that?" Kremez said. "It's possible that InfoArmor has a different data set."

InfoArmor's Komarov said his company is happy to work with law enforcement, Yahoo and other independent parties to examine the data he's recovered. A sample of the data is available in the company's findings.

IDG News Service tried some of the sample login IDs and found that Yahoo recognized some. The login IDs also didn't appear to be recycled from other leaked databases. However, Yahoo didn't recognize some of the other IDs.

Komarov said that although most of Group E's clients are spammers, they had at least one customer who was a state-sponsored actor. The stolen Yahoo database might have been used to target U.S. government officials, InfoArmor said in its report. 

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Michael Kan

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?