Yahoo data breach (2013): what happened and what to do
2 min read · Updated October 15, 2026
In 2013 attackers stole data from Yahoo accounts. Yahoo first disclosed the incident in 2016 and in 2017 said all roughly three billion accounts existing at the time had been affected. Exposed data included names, email addresses, phone numbers, birth dates and hashed passwords. Change old Yahoo passwords and check your email for exposure.
What happened
Yahoo announced in December 2016 that data from more than a billion accounts had been stolen in 2013. In October 2017 the company revised the estimate, saying that every account that existed at the time, about three billion, had been affected. A separate 2014 intrusion, announced in 2016, involved around 500 million accounts.
What was exposed
- ✓Names, email addresses, telephone numbers and dates of birth.
- ✓Hashed passwords.
- ✓In some cases, encrypted or unencrypted security questions and answers.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
Why it still matters
Many people never changed passwords from that era, and some reused them across services. Old leaked data keeps circulating, and security-question answers cannot be changed as easily as passwords.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Was my Yahoo account part of the breach?+
If you had an account in 2013, the company said all accounts at the time were affected. A breach check can show whether your address appears in known records.
Are Yahoo accounts safe now?+
Accounts can be secured with a unique password and two-step verification.
Do I need to change security questions?+
If you reused answers elsewhere, update them or move to methods that do not rely on them.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.