Yahoo! is expected to confirm its unwelcome distinction of being the victim of the largest data breach on record. A report has the tech giant is expected to disclose details of a hack that has affected some 200 million Yahoo users. 
 
 Yahoo! Inc., is preparing to confirm a “massive data breach” of its core service, one that could affect and expose ‘several’ hundred million user accounts. 
 
 Tech news site Recode broke the news, citing sources who noted the breach to be “widespread and serious”, with the likelihood of legal action and investigations led by the government. 
 
 The revelation would come at a time when Yahoo is the midst of a mega-acquisition by Verizon in a $4.8 billion deal and it remains to be seen if the deal could see repercussions due to the breach. 
 
 Earlier in August, Motherboard reported that a cybercriminal hacker who goes by the moniker “Peace” was advertising the sale of 200 million Yahoo accounts. The same hacker has previously sold large data dumps of breaches related to Myspace and LinkedIn on a dark web marketplace called the Real Deal. 
 
 While the lagging technology giant admitted that it was investigating the data breach, a Recode source confirmed that the number of users affected could be more than the 200 million advertised by Peace. 
 
 “It’s as bad as that,” said the Recode source. “Worse, really.” 
 
 The data trove reportedly contains Yahoo users’ usernames, scrambled passwords, birthdates and other information, likely dated from 2012. 
 
 Peace was hawking the alleged data of 200 million users for a relatively mere 3 bitcoins, around $1900 in value at the time. 
 
 Featured image from iStock/4×6. ||||| Yahoo CEO Marissa Mayer. Getty/Kimberly White Yahoo is getting ready to confirm a huge, historic hack affecting 200 million users, Recode reports. 
 
 Back in August, Motherboard's Joseph Cox reported that 200 million apparent Yahoo user credentials were being sold on the dark web. At the time, the company's response was only that it was "aware of [the] claim." 
 
 But now Kara Swisher, one of the tech industry's most respected journalists, is reporting for Recode that Yahoo sources tell her the company is preparing to publicly confirm the hack. (Her sources did not confirm its exact size, only that it was "widespread and serious.") 
 
 Yahoo did not immediately respond to Business Insider's request for comment. 
 
 Motherboard was told by the hacker who held the data (and was selling it for 3 bitcoins, worth $1,860 at the time) that the breach was carried out in 2012 — and was never made public. Data included usernames, encrypted passwords, date-of-births, and some email addresses. 
 
 A spate of historic data breaches affecting millions of users have recently been coming to light, affecting companies including LinkedIn, MySpace, and Tumblr. If user passwords are unencrypted (or not encrypted properly), hackers can then use this login data to break into individual user accounts — and often, because people reuse passwords across multiple sites, the hackers can use the information to break into accounts on other sites as well. 
 
 We saw multiple high-profile demonstrations of this problem this summer, as celebrities and public figures including Mark Zuckerberg and Drake had their Twitter accounts broken into. Twitter wasn't hacked — but the victims had reused passwords that were also used on hacked websites. 
 
 This new attention on the alleged breach comes at an awkward time for Yahoo. The tech company is selling its core business to Verizon for $4.8 billion (£3.7 billion) after years of flagging fortunes. 
 
 There's nothing ordinary users can do to prevent these kinds of breaches, but using a strong, unique password on each website or service you have an account on (managing those passwords with a password-manager app if necessary) will help limit the damage. ||||| Now playing: Watch this: 500 million Yahoo accounts stolen 
 
 Hackers swiped personal information associated with at least a half billion Yahoo accounts, the internet giant said Thursday, marking the biggest data breach in history. 
 
 The hack, which took place in 2014, revealed names, email addresses, phone numbers, birth dates and, in some cases, security questions and answers, Yahoo said in a press release. Encrypted passwords, which are jumbled so only a person with the right passcode can read them, were also taken. 
 
 The internet pioneer, which is in the process of selling itself to Verizon, said it's "working closely" with law enforcement. It called the hackers a "state-sponsored actor," though it didn't identify a country behind the breach. 
 
 Yahoo urged users to change their passwords if they haven't since 2014. The company has 1 billion monthly active users for all its internet services, which span finance, online shopping and fantasy football. Its mail service alone has about 225 million monthly active users, Yahoo told CNET in June. 
 
 The hack serves as a reminder of how widespread hacking is and highlights the vulnerability of passwords. Cybersecurity specialists recommend using a different password for each account you have on the internet. Other experts are working on alternatives to passwords, such as biometrics like your fingerprint or retina. 
 
 "Cybercriminals know that consumers use the same passwords across websites and applications, which is why these millions of leaked password credentials are so useful for perpetuating fraud," said Brett McDowell, executive director of the FIDO Alliance, an organization that vets the security of password alternatives. "We need to take that ability away from criminals, and the only way to do that is to stop relying on passwords altogether." 
 
 Justin Sullivan, Getty Images 
 
 Verizon, which is paying $4.83 billion for Yahoo, said it was notified of the massive breach within the last two days. The telecommunications giant had "limited information and understanding of the impact," according to a statement. 
 
 "We will evaluate, as the investigation continues, through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities," Verizon said. 
 
 B. Riley & Co. analyst Sameet Sinha told The Wall Street Journal the breach was unlikely to affect the sale to Verizon. 
 
 Virginia Sen. Mark Warner, a member of the newly formed Senate Cybersecurity Caucus, criticized Yahoo for not discovering the breach when it originally happened in 2014. 
 
 "While we have seen more and more data breaches in the private sector in recent years, many of them affecting millions of consumers, the seriousness of this breach at Yahoo is huge," Warner said. 
 
 The Privacy Rights Clearinghouse, a nonprofit organization that tracks cybersecurity breaches, said the hack was the largest-ever publicly disclosed breach. 
 
 Yahoo has taken steps to protect its users, including invalidating security questions and answers, but the real risk lies in hackers using the passwords on other websites. 
 
 "We typically see a 0.1 percent to 2 percent log-in success rate from credential stuffing attacks, meaning that a cybercriminal using 500 million passwords to attempt to take over accounts on another website would be able to take over tens of thousands of accounts on most websites," said Shuman Ghosemajumder, Google's former click-fraud czar and CTO of Shape Security. 
 
 Facebook co-founder Mark Zuckerberg's Twitter account was hacked using a similar method after the passwords of more than 100 million LinkedIn members were leaked. 
 
 It will take Yahoo at least several months before it starts regaining users' trust, according to research from Alertsec. The encryption provider did a study that found about 97 percent of Americans lose trust in companies like Yahoo after massive data breaches. 
 
 "When a company has allowed their customers' data to fall into the hands of criminals, the resulting lack of trust is difficult to repair," CEO Ebba Blitz said in a statement. 
 
 On August 1, a hacker named "Peace" claimed to have breached 200 million Yahoo usernames and passwords from a hack in 2012, and offered to sell them on the dark web after trying to do the same with MySpace and LinkedIn accounts. 
 
 A person familiar with the situation said Peace's assertion prompted Yahoo to initiate an internal investigation. That investigation found no evidence that substantiated Peace's claim, but the investigating team found indications that a state-sponsored actor had stolen data in 2014. 
 
 Former Yahoo information security officer Jeremiah Grossman, now chief of security strategy at SentinelOne, said that internet companies, especially giants like Yahoo, face challenges protecting enormous computer networks because the networks offer so many points of entry to attackers. 
 
 "It's unsurprising when breaches, even of this magnitude, take place," Grossman said. "Yahoo certainly isn't the first. And they won't be the last." 
 
 
 
 This story was originally published at 6:30 a.m. PT. 
 
 Updates, 10:20 a.m., 12:09, 12:41, 2:08, 2:30, 3:10, 4:15 and 4:42 p.m. PT: Added details of the 2012 hack that affected Yahoo, LinkedIn and MySpace, and added statements from Yahoo and Verizon, and analysis from experts.
– Yahoo is confirming what Recode describes as a "widespread and serious" data breach affecting 500 million users. Yahoo blames "state-sponsored actors" for the personal data that was stolen in 2014 but only recently discovered to have been stolen, the AP reports. Yahoo had previously been expected to confirm an estimated 200 million users were affected. Motherboard spoke in August to a hacker known as "Peace” who claimed to be hawking data from 200 million Yahoo accounts on the dark web, per Business Insider. The hacker said the data—which includes usernames, passwords, security questions and answers, birth dates, phone numbers, and email addresses—was likely stolen in 2012. No such breach was ever made public. However, Yahoo said at the time that it was "aware of the claim" and was investigating. Confirmation of such a breach—which Hacked.com says could be "the largest data breach on record"—could now affect Yahoo's $4.8 billion sale to Verizon. Not only is it a pain for Verizon, but Yahoo shareholders will be concerned about a possible drop in the company's sale price. The sources tell Recode that government investigations and legal action in regards to breach are expected. In its confirmation of the breach, Yahoo suggested users change their passwords, assuming they haven't already done so since 2014.