2014 breach (disclosed 2016) — 500M accounts
Data compromised
Email addresses, Passwords (hashed), Names, Session cookies
Technical writeup
State-sponsored actors stole data from at least 500 million Yahoo accounts in 2014. Data included names, emails, hashed passwords, and security Q&A. Disclosed alongside the 2013 breach.
Root cause
Cookie forgery and persistent access; delayed detection and disclosure.