Yahoo!
Disclosed Sep 22, 201610 years ago515,000 affectedSettled
2014 Yahoo breach hit 515,000 UK accounts; ICO fine of GBP 250,000
The 2014 Yahoo breach, disclosed publicly in September 2016, affected about 500 million accounts including more than 515,000 UK accounts controlled by Yahoo UK Services. The ICO fined it GBP 250,000 under the Data Protection Act 1998 for security and oversight failures.
What is known
| People affected | 515,000 (as reported by the organization) |
|---|---|
| Disclosed | Sep 22, 2016 |
| Happened | Aug 13, 2016 |
| Attack | Hacking |
| Data exposed | Names, Emails, Phone numbers, Dates of birth, Passwords, Other, Addresses |
| Sector | Tech · US |
| Status | Settled |
| Lawsuit or fine | GBP 250,000 ICO fine (June 2018); USD 35M SEC penalty on Altaba (2018) (about $334K) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Yahoo!oag.ca.gov · Official notice | Official notice |
| Yahoo 8-K Ex. 99.1 (September 22, 2016)sec.gov · SEC filing | SEC filing |
| Yahoo 8-K Ex. 99.1 (December 14, 2016)sec.gov · SEC filing | SEC filing |
| Altaba, Formerly Known as Yahoo!, Charged With Failing to Disclose Massive Cybersecurity Breach; Agrees To Pay $35 Millionsec.gov · Regulator | Regulator |
| Yahoo data breaches (Wikipedia)en.wikipedia.org · News | News |
| UK watchdog issues $330k fine for Yahoo's 2014 data breachtechcrunch.com · News | News |
| Maine Attorney General breach notice archive: Yahoomaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Sep 22, 2016 | |
| Researchtotal | Sep 22, 2016 | 500,000,000 |
| Researchtotal | Sep 22, 2016 | 515,000 |
| Maine AGresidents of ME | Sep 22, 2016 | 213,487 |
| California AGresidents of CA | Dec 14, 2016 | |
| Researchtotal | Dec 14, 2016 | 1,000,000,000 |
| Maine AGresidents of ME | Dec 14, 2016 | 2,448,000 |
| Maine AGresidents of ME | Feb 15, 2017 | |
| Maine AGresidents of ME | Oct 3, 2017 |
Other breaches at Yahoo!
| Breach | Affected | ||||
|---|---|---|---|---|---|
| SQL injection on Yahoo Voices leaks about 450,000 plaintext passwordsJul 12, 201214 years agoHackingUnverified | Jul 12, 201214 years ago | Hacking | Tech | Unverified | 453K |
History of this record
- 2026-09-25 · data_types: ["names","emails","phone","dob","passwords","other"] to ["names","emails","phone","dob","passwords","other","addresses"] · backfill source
- 2026-09-25 · occurred: empty to 2016-08-13 · backfill source
- 2026-09-25 · source: empty to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsx · backfill source
- 2026-09-25 · fine_usd: 35000000 to 334000 · seed source
- 2026-09-25 · lawsuit: $35M SEC penalty for failure to disclose (2018) to GBP 250,000 ICO fine (June 2018); USD 35M SEC penalty on Altaba (2018) · seed source
- 2026-09-25 · records: 500000000 to 515000 · seed source
- 2026-09-25 · summary: Yahoo confirmed that information associated with at least 500 million user accounts, including names, emails, phone numbers, birth dates, hashed passwords and some security questions, was stolen in late 2014 by what it believed was a state- to The 2014 Yahoo breach, disclosed publicly in September 2016, affected about 500 million accounts including more than 515,000 UK accounts controlled by Yahoo UK Services. The ICO fined it GBP 250,000 under the Data Protection Act 1998 for se · seed source
- 2026-09-25 · title: State-sponsored actor stole data tied to 500 million Yahoo accounts in 2014 to 2014 Yahoo breach hit 515,000 UK accounts; ICO fine of GBP 250,000 · seed source
- 2026-09-25 · status: confirmed to settled · seed source
- 2026-09-25 · fine_usd: empty to 35000000 · seed source
- 2026-09-25 · lawsuit: empty to $35M SEC penalty for failure to disclose (2018) · seed source
- 2026-09-25 · records: 1000000000 to 500000000 · seed source
- 2026-09-25 · summary: Yahoo disclosed that an unauthorized third party stole data associated with more than one billion user accounts in August 2013, including names, emails, phone numbers, birth dates, MD5-hashed passwords and some security questions. The figur to Yahoo confirmed that information associated with at least 500 million user accounts, including names, emails, phone numbers, birth dates, hashed passwords and some security questions, was stolen in late 2014 by what it believed was a state- · seed source
- 2026-09-25 · title: August 2013 theft of data from more than one billion Yahoo accounts to State-sponsored actor stole data tied to 500 million Yahoo accounts in 2014 · seed source
- 2026-09-25 · sector: other to tech · seed source
- 2026-09-25 · attack: unknown to hacking · seed source
- 2026-09-25 · data_types: [] to ["names","emails","phone","dob","passwords","other"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 1000000000 · seed source
- 2026-09-25 · summary: empty to Yahoo disclosed that an unauthorized third party stole data associated with more than one billion user accounts in August 2013, including names, emails, phone numbers, birth dates, MD5-hashed passwords and some security questions. The figur · seed source
- 2026-09-25 · title: empty to August 2013 theft of data from more than one billion Yahoo accounts · seed source
- 2026-09-25 · disclosed: 2016-12-14 to 2016-09-22 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.