Story image

Yahoo's data hack nightmare continues

28 Sep 16

Poor Yahoo. First it had to come out and admit the theft of data associated with at least 500 million user accounts, then it had to deal with claims the hack was the biggest in history.

Now, The Privacy Commissioner has confirmed it is monitoring the situation, with Commissioner John Edwards saying the hack exemplifies the international nature of privacy.

The Yahoo hack included names, email addresses and security questions and answers used to reset passwords.

The hack affects a portion of the 825,000 email accounts that Spark provides to users through its partnership with Yahoo. According to a statement from Spark, 130,000 customers have potentially been put at risk.

Most Spark customers have probably not had their security questions and answers compromised.

According to Edwards, it is not yet clear when Yahoo learned about the hack, which took place in 2014.

“When agencies lose customer data, they need to help those customers take steps to protect themselves by alerting them as quickly as possible,” the Commissioner says.

“This is particularly true with a breach of this size and with such sensitive information,” he explains.

“Email accounts are often a central repository of peoples’ online identities, so a compromised email account can lead to other information being compromised, such as banking and medical information.”

Proposed reforms to the Privacy Act include mandatory breach notification, where agencies must report breaches of a certain scale. These reforms are due to be tabled in Parliament in 2017.

“We are grateful that Spark quickly alerted us about this breach and immediately began taking action to resolve it,” says Edwards.

“However, the fact that Yahoo may have known about the breach for a number of months before alerting the public shows why we need mandatory breach notification,” he notes.

"Every day counts in a data breach and agencies need greater incentive to take a leaf out of Spark’s book by promptly telling customers that their personal information has been compromised.”

The US Federal Trade Commission and Irish Data Protection Commissioner are already working together to make enquiries into the incident.

Wine firm uses AR to tell its story right on the bottle
A Central Otago wine company is using augmented reality (AR) and a ‘digital first’ strategy to change the way it builds its brand and engages with customers.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
Protecting organisations against internal fraud
Most companies tend to take a basic approach that focuses on numbers and compliance, without much room for grey areas or negotiation.
Telesmart to deliver Cloud Calling for Microsoft Teams
The integration will allow Telesmart’s Cloud Calling for Microsoft Teams to natively enable external voice connectivity from within Teams collaborative workflow environment.
Jade Software & Ambit take chatbots to next level of AI
“Conversation Agents present a huge opportunity to increase customer and employee engagement in a cost-effective manner."
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
GirlBoss wins 2018 YES Emerging Alumni of the Year Award
The people have spoken – GirlBoss CEO and founder Alexia Hilbertidou has been crowned this year’s Young Enterprise Scheme (YES) Emerging Alumni of the Year.
SingleSource scores R&D grant to explore digital identity over blockchain
Callaghan Innovation has awarded a $318,000 R&D grant to Auckland-based firm SingleSource, a company that applies risk scoring to digital identity.