bhisawa via Flickr CC
Yahoo has provided the Senate commerce committee with new details about its security breaches over the past four years. Here's what you need to know:
The damning tidbit: The accounts involved in Yahoo's series of breaches in 2013 and 2014 were mostly the same ones.
Yahoo hired a risk management executive and is reportedly more engaged with law enforcement than was previously public; it is working with federal, state, and foreign government officials about the breaches. Recall that Yahoo only learned of its 2013 breach in 2016 when user data turned up online.
The specifics on its cyber security updates: Yahoo is growing its Advanced Persistent Threat team to better deal with state-sponsored attacks (which likely caused the 2016 breaches). The company also takes a "kill chain" approach to detect attacks, runs a vulnerability assessment team that attacks its own products (the "red team"), and has a "bug bounty program" that pays those external to Yahoo to inform it of bad code.
Plus, Yahoo will present its briefing to the Senate committee via a committee it formed internally just to investigate the breaches. The briefing is not yet scheduled.