Yahoo! Voices Server Gets Hacked, 400K Passwords Stolen

The Yahoo! Voices service was hacked on Thursday and more than 400,000 usernames and passwords were stolen. The re-branded Associated Content server associates user passwords with a users email address not just from Yahoo but also from Gmail, AOL and others.

Purchased by Yahoo in May 2010 the Associated Content platform was fully integrated with Yahoo in December 2011 and features crowd-sourced question and answers.

According to Trusted Sec:

“The (large) text file was stored on the d33ds.co web server, but was not available at the time of this writing and has likely been pulled as the root domain is still connectable.”

After hacking the passwords the hackers responsible left Yahoo a messaging, lecturing them about a lack of proper security protocols. The hackers wrote:

“We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat. There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage.”

The scariest part of the hack appears to be that Yahoo stored user information inside a plain text document with absolutely zero encryption.

LulzSec, Anonymous and other hacking groups have failed to come forward and claim responsibility at this time.

Do you think company’s that fail to secure user data with proper security methods should face fines for their lack of user protections?