The Justice Department announced charges in the mega data breach at Yahoo that affected at least 500 million users
Last Updated Mar 15, 2017 1:20 PM EDT
The Justice Department on Wednesday announced charges against four defendants — including two Russian security services officers — in a mega data breach at Yahoo that affected at least a half billion user accounts. In a statement, Attorney General Jeff Sessions called this “one of the largest data breaches in history.”
Two of the defendants named are Russian FSB officers, and the other two are criminal hackers. One defendant has been taken into custody in Canada, and another is on the list of the FBI’s most wanted cyber criminals. The four are accused in a 47-count indictment of computer hacking, economic espionage and other conspiracy charges.
Justice Department attorneys called this a highly complex, long-term investigation that relied heavily on cooperation between the federal government and the private sector, especially Yahoo and Google.
Yahoo announced Wednesday hackers accessed more than a billion accounts in August 2013. They believe this is separate from a 2014 breach that aff…
One defendant, the Justice Department says, searched Yahoo user communications “for credit card and gift card account numbers, redirecting a subset of Yahoo search engine web traffic so he could make commissions,” and he also enabled the theft of the contacts of at least 30 million Yahoo accounts to utilize for a spam campaign.
The defendants named by DOJ are Russian nationals and residents Dmitry Aleksandrovich Dokuchaev, 33; Igor Anatolyevich Sushchin, 43; Alexsey Alexseyevich Belan, aka “Magg,” 29; and Karim Baratov, aka “Kay,” “Karim Taloverov”. And the other defendant, “Karim Akehmet Tokbergenov,” 22, is a Canadian and Kazakh national and lives in Canada.
From left, Dmitry Dokuchaev, Igor Sushchin and Alexsey Belan are seen a combination of photos provided by the FBI.
The charges arise from a compromise of Yahoo user accounts that began in January 2014, and the accused conspirators used the information they stole up until at least December 2016, the Justice Department said. Belan, who in 2013 was named by the FBI as one of its most wanted cyber criminals, was arrested in Europe 2013, but escaped to Russia. In late 2014, Belan stole a copy of Yahoo’s User Database, according to the indictment. It’s a Yahoo trade secret that contained user names, recovery email accounts, phone numbers and authenticating information for half a billion Yahoo accounts.
The two FSB officers, Dokuchaev and Sushchin, gave Belan sensitive law enforcement and intel that helped him avoid being detected by U. S. law enforcement, a Justice Department statement said.
Though the Justice Department has previously charged Russian hackers with cybercrime – as well as hackers sponsored by the Chinese and Iranian governments – this would be the first criminal case brought against Russian government officials.
It comes as federal authorities investigate Russian interference through hacking in the 2016 presidential election. However, acting Assistant Attorney General Mary McCord told reporters that this indictment “doesn’t allege any connection” to the DNC breach from the summer of 2016. McCord also said that the massive hacking may have had some intelligence value, but the actions undertaken by the defendants lined their own pockets for private financial gain.
Yahoo didn’t disclose the 2014 breach until last September when it began notifying at least 500 million users that their email addresses, birth dates, answers to security questions and other personal information may have been stolen. Three months later, Yahoo revealed it had uncovered a separate hack in 2013 affecting about 1 billion accounts, including some that were also hit in 2014.
