Yahoo Executives Detected a Hack Tied to Russia in 2014
Unclear whether hack was tied to massive breach disclosed Thursday
By ROBERT MCMILLAN
Sept. 23, 2016 5:41 p.m. ET
Yahoo Inc. executives detected hackers in their systems in fall 2014 who they believed were linked to Russia and were seeking data on 30 to 40 specific users of the company’s online services, a person familiar with the matter said.
The person familiar with the matter didn’t know whether that attack led to the theft of information on 500 million user accounts, which Yahoo disclosed Thursday. In that disclosure, Yahoo said the information was stolen from its network in late 2014 by a “state-sponsored actor.”
The person familiar with the matter said the intrusion was discovered several weeks after the attack. The person said Yahoo reported the incident to the Federal Bureau of Investigation at the time. The FBI didn’t immediately respond to a Wall Street Journal request for comment.
When asked for comment, a Yahoo spokesman pointed out law enforcement is investigating the theft of data it had disclosed Thursday.
A spokesman at the Russian Embassy in Washington didn’t respond to a request for comment.
At the time of the 2014 attack, Yahoo executives concluded that it was linked to Russia because it was launched from computers in Russia, the person familiar with the matter said. In addition, the person said, the targets were people who did business in Russia.
Security investigators say it isn’t unusual for more than one hacker to break into corporate networks simultaneously, sometimes muddying the water surrounding an investigation.
The person familiar with the matter said several other technology companies suffered similar targeted attacks in late 2014. The person didn’t name any other targeted companies.
In recent months, hackers linked by U.S. investigators to the Russian government have allegedly leaked email messages belonging to the Democratic National Committee, which Russian officials have denied. Emails from former Secretary of State Colin Powell also were recently posted on a website with suspected ties to Russian intelligence services.
Write to Robert McMillan at Robert.Mcmillan@wsj.com
