In this interview, identity‑theft analyst Robert Siciliano discusses the massive Yahoo data breach that exposed over a billion user accounts. He explains why every Yahoo user should be concerned, emphasizing that compromised email accounts serve as a gateway for resetting passwords on other critical services. Siciliano notes that Yahoo has not disclosed how or why the breach occurred, describing it as unprecedented and still unexplained. He evaluates the business fallout, suggesting that the breach could jeopardize Yahoo’s pending deal with Verizon and affect its advertising revenue. The conversation also critiques Yahoo’s organizational state, portraying the company as an outdated news aggregator plagued by leadership turnover and a lack of innovation. Finally, Siciliano highlights that most consumers will never detect fraud stemming from the breach, estimating that about 90% of compromised accounts go unnoticed due to users’ limited awareness of their digital footprints.
Chapters
Robert Siciliano is an identity theft analyst at Hotspot Shield. He joins us now from Newton, Massachusetts. If one has a Yahoo email account, how worried should we be?
The fact that, uh, over a billion and a half accounts were compromised means that simply everyone that has a Yahoo account should be concerned. Once a criminal hacker has access to your email, that is a portal to reset the password for all of your critical accounts in which that Yahoo account is associated with.
How's it taken them so long to tell us this has happened? Please do not tell me, Robert Siciliano, that it's because they didn't know.
I wish. That I could not tell you it's because they didn't know. News reports today are saying that they just don't know how or why. They can't determine the nature of the breach. This is a, uh, security breach, uh, that is unprecedented. We've used that word quite a bit, a lot lately, and this particular breach, uh, we can associate it with as well. We've never seen anything like this before, and the fact that they don't know how or why even today is problematic.
Okay. They were just about to do a big deal with Verizon. If you were Mr. Verizon Inc., would you now be pulling the plug on that?
I would certainly be concerned. One has to look at the monetary value of Yahoo's current book of business, how much revenue they're generating. And whether or not the existing customer base, as far as email accounts go, if that at all affects the bottom line other than, you know, any lead generation advertising they may be doing.
Why does this kind of thing keep on happening to Yahoo!? I mean, is there somebody in the corporate food chain, not necessarily a computer expert, but somebody who runs it as a business, who's taken their eye off the ball here? Because, correct me if I'm wrong, there is a perception that alongside AOL, Yahoo is quite— it feels as if it's an old-fashioned company now. The world has moved on. It's all about the app and swiping on your iPad. It's not about sitting down, logging in, and clicking with a mouse. There's that feeling that Yahoo's very 1990s, very turn of the century almost.
Yeah, I agree with you 100%. It is more of a news aggregator at this point, more than an innovator of any kind. And they certainly have, you know, fallen by the wayside. They've been playing catch-up for quite some time, going through various CEOs and so forth. There has been quite a bit of disruption, not in a good way, at that company. And this is just a product or an effect of what has gone on within that organization.
Do you think there's a chance here, if one has been hacked, we may never know because We all have multiple email accounts now going into multiple devices. We all have passwords for this, passwords for that. Regularly one has to reset one's iTunes password. I had to do it last night for no apparent good reason. But that kind of hack can be so sophisticated, so subtle, you may not be aware of it.
Yeah, from my own research, I would deduce that as much as 90% of those who are hacked in this way, where their email account is compromised, that they just simply cannot pinpoint any fraud as a result of that kind of a breach, meaning that most consumers in general are relatively disconnected from their digital lives as in regards to if fraud was to occur, would they be able to deduce how and why? Most consumers aren't nearly as tuned in or really as sophisticated as they should be to determine where that— where a particular breach may have occurred in their digital lives, and their Yahoo account may be the furthest thing from their consciousness in regards to, say, a credit card being compromised or an account being taken over or a new account being created under their name.
