Two Russian Spies Charged in Massive Yahoo Data Breach -- Update

By Aruna Viswanatha 

Federal authorities have charged four men, including two officers from Russia's spy agency, with hacking computer systems at Yahoo Inc. and stealing personal data that affected hundreds of millions of Yahoo users, in the first such case to directly target the Russian government.

Two of the men, Dmitry Dokuchaev and Igor Sushchin, are officers at Russia's secretive Federal Security Service who protected, directed, facilitated, and paid others to collect information through computer intrusions in the U.S. and elsewhere, authorities said.

Authorities said they worked with co-conspirators Alexsey Belan and Karim Baratov to hack into computers of American companies providing email and internet-related services.

Mr. Baratov, a Canadian and Kazakh national, was taken into custody on Tuesday in Canada, authorities said. The other men are believed to be in Russia. There is no extradition treaty between Russia and the U.S., so U.S. authorities would only be able to get them in custody if they travel overseas to another country that is willing to send them to the U.S.

The men used unauthorized access to Yahoo's systems to steal information from about at least 500 million Yahoo accounts and then used some of that stolen information to obtain unauthorized access to the contents of accounts at Yahoo, Google and other webmail providers, including accounts of Russian journalists, U.S. and Russian government officials and private-sector employees of financial, transportation and other companies, the Justice Department said in a statement Wednesday.

Other personal accounts belonged to employees of commercial entities, such as a Russian investment banking firm, a French transportation company, U.S. financial services and private-equity firms, a Swiss bitcoin wallet and banking firm and a U.S. airline, the Justice Department said.

Yahoo's servers were compromised by hackers in two separate incidents, stealing data on more than 1 billion accounts during a 2013 incident. A separate 2014 incident, which Yahoo had previously linked to "state-sponsored" hackers, compromised data on more than 500 million accounts.

The compromised data includes Yahoo addresses linked to more than 150,000 members of the federal government and U.S. military, according to an analysis by the security firm InfoArmor Inc.

The hacking incidents, both among the largest-ever reported thefts of personal data, presented a major stumbling block to Verizon Communications Inc.'s efforts to acquire Yahoo's core business assets. Yahoo disclosed both breaches months after Verizon made its initial bid on the internet company in July 2016. Last month, the companies revised the terms of their deal, with Verizon now paying $4.5 billion -- a $350 million price reduction -- and both companies agreeing to split any future costs related to the breaches.

Yahoo executives were apparently unaware of the 2013 breach until December of last year, but the company knew of the 2014 incident soon after it occurred. It is unclear why Yahoo waited approximately two years to disclose that breach, and this delay is now the subject of an investigation by federal authorities, including the Securities and Exchange Commission.

Last month, Yahoo's top lawyer, Ronald Bell, resigned in the wake of the hacks, and Yahoo's board elected not to award Chief Executive Marissa Mayer her 2016 cash bonus and accepted her offer to forgo her 2017 equity awards.

A Yahoo board investigation blamed the mishandling of the hacking incident on "failures in communication, management, inquiry and internal reporting" and a "lack of proper comprehension," the company said in an SEC filing earlier this month.

--Robert McMillan contributed to this article.

Write to Aruna Viswanatha at [e-mail]

(END) Dow Jones Newswires

March 15, 2017 13:06 ET (17:06 GMT)

Copyright (c) 2017 Dow Jones & Company, Inc.