Yahoo account users should probably change their passwords as a Russian hacking group is reportedly selling over 200 million accounts in the black market for three bitcoins or $1824.
Those who are interested in the stolen Yahoo accounts can buy them on TheRealDeal which is a marketplace located in the Dark Web. Users need to have a TOR browser in order to access the Dark Web sites as they are hidden from the surface of the Internet.
The soon-to-be-owned by Verizon company did not confirm nor deny whether the stolen accounts were indeed real. Yahoo said that their security team is already verifying the reports to see whether the accounts being sold are actually valid, Computerworld has learned.
Over 200 million Yahoo accounts are now being sold by a hacker called peace_of_mind which is ironic considering that the users who had their accounts hacked should not have any peace of mind at all. The hacker said that the stolen accounts database was taken from a Russian hacking group.
Peace_of_mind claimed that there have been several copies of the stolen Yahoo database sold in the past few days after it was posted on TheRealDeal. The Yahoo accounts database included the usernames and passwords hashed with MD5 which is easily decrypted using decrypting tools available online, Motherboard reported.
Fortunately, not all of the accounts in the stolen Yahoo database are valid. Motherboard tested some of the accounts and found that they did not correspond to the actual accounts.
There were also accounts that were deactivated or discontinued. Most of the accounts were believed to be taken from a Yahoo data breach in 2012 which could explain all of the inactive accounts.
If hackers were indeed able to login the stolen Yahoo accounts, they could search for banking information and other sensitive data especially if the accounts belonged to corporate executives or even government officials, although there are no reports yet of famous personalities having their Yahoo accounts hacked.
Despite the lack of evidence that the stolen Yahoo accounts are valid, users are still urged to change their passwords. This prevents hackers from logging in their accounts if they are indeed part of the stolen Yahoo database.