In July 2012, the hacking group D33DS Company exploited a union-based SQL-injection vulnerability in Yahoo Voices, formerly Associated Content, and published a database containing approximately 450,000 usernames, email addresses, and passwords. The credentials were stored in plaintext rather than hashed, allowing anyone who obtained the dump—distributed online through BitTorrent—to use them immediately. Yahoo had acquired Associated Content for $100 million in May 2010, and the affected platform reportedly had more than 600,000 contributors at the time.
Yahoo confirmed that an older Yahoo Contributor Network file had been compromised, while stating that fewer than 5% of the exposed Yahoo accounts had valid passwords. The company said it would fix the vulnerability, change affected Yahoo passwords, and notify other companies whose users might have reused the credentials. Critics also faulted Yahoo for failing to integrate the older accounts promptly into its stronger general login system and for not issuing site-wide or individualized notifications. Security researcher Joseph Bonneau, a former Yahoo product analysis manager, specifically criticized those failures. The breach became an early warning of the broader security problems that preceded Yahoo’s much larger disclosures in 2016.
