The Really Scary Detail You Overlooked in Yahoo’s Data Theft Statement

In brief: Yahoo disclosed a large-scale breach in which attackers—reported as state-sponsored—stole data on roughly one billion user accounts and proprietary code/secret used to generate authentication cookies, enabling the attackers to forge valid session cookies and impersonate users. The incident reflects deep, long-term access to Yahoo's internal systems and raises severe risks of account takeover and misuse of stolen data; Yahoo has invalidated forged cookies and recommended users enable multi-factor authentication.