Yahoo! joins the growing list of websites suffering security breaches. Just one day after social networking site Formspring gets hacked resulting in about 420,000 user accounts compromised, Yahoo’s user-generated contributor network Yahoo! Voices experienced a massive security breach with more than 400,000 usernames and passwords stolen and briefly posted online.

Unlike the Formspring breach wherein the data posted were encrypted, Yahoo’s account info was stored unencrypted so the list of usernames and their corresponding passwords were posted in text. And it’s not just Yahoo accounts that are affected here as Yahoo! Voices also allows users to sign in using non-Yahoo! email addresses. Gmail, MSN, Hotmail, Comcast and AOL user accounts were also included in the list of compromised accounts. Even more serious is the fact that there are also some accounts using .gov and .mil addresses indicating possible government and military accounts.
There is a silver lining to the situation, though. The group who were apparently responsible for this breach claims that it was only done to alert the company of the website’s security weaknesses, leaving a message for the company wherein they ask that those responsible for the domain’s security will look at this as a “wake-up call, and not a threat”.
Yahoo is already working to fix the website’s vulnerability while an investigation is still under works. The company has already released a statement saying that the data stolen was an older file from Yahoo Contributor Network acquired when the company purchased Associated Content and that less than 5% of the posted account info had valid passwords. Nevertheless, the company has issued an apology to its users and also alerted them, particularly those with compromised accounts, to change their passwords and get to know Yahoo’s online safety tips.
Now if you’re wondering whether your account is one of those compromised, there is a way to find out. Sucuri Malware Labs has a website where you can check if your email is included in the leak. Simply go to labs.sucuri.net then enter your email address on the query box and it will tell you whether or not your account has been compromised.
Pinoytutorial Techtorial » Web Matters