Independent public-records tracker. Not a government website.Facts from official state, HHS and SEC filings
BreachRecord

Yahoo Inc. Data Breach (December 2016): What Was Exposed and What To Do

Last updated Oct 20, 2026 · Based on 3 official filings · See sources

According to the notice filed with the Maine Attorney General on Dec 14, 2016, Yahoo Inc. reported a data breach. It was also reported to the California Attorney General. People affected: At least 2,448,000 people in 1 state (Maine residents, Maine Attorney General filing).

Key facts

From 3 official filings
Organization
Yahoo Inc.
Also filed as: Yahoo! Inc.
Source: Maine Attorney General, filed Dec 14, 2016
People affected
At least 2,448,000
At least 2,448,000 people in 1 state (Maine residents, Maine Attorney General filing)
Source: Maine AG, Dec 14, 2016
Incident dates
Aug 13, 2016
Source: Maine Attorney General, filed Dec 14, 2016
Notice dates
First filed Dec 14, 2016; latest filing Feb 15, 2017
Source: Maine Attorney General, filed Dec 14, 2016
Information exposed
  • Date of birth
  • Username and password
  • Name
  • Phone number
  • Email address
  • Other information
Sources: Maine AG, Dec 14, 2016; Maine AG, Feb 15, 2017
Filed with
Free credit monitoring
No offer is stated in the filings we have. Check your letter.

What to do now

Steps chosen from the information listed in the official filings. Your own letter may list more.

  1. Change the password for the affected account and for any other account where you used the same password. Use a different password for every account (a password manager can help) and turn on two-step verification where it is offered.

  2. Scammers often contact people after a breach, pretending to be the organization, a bank or a government agency. Do not give your Social Security number, passwords or codes to anyone who contacts you first.

  3. You can get free credit reports from all three bureaus at AnnualCreditReport.com, the official site.

  4. The Federal Trade Commission's IdentityTheft.gov gives you a personal recovery plan.

Is the letter real?

Letters usually list a phone number for questions. We could not find an official copy of the letter, so check that the organization named in your letter appears in the official filings listed below before you call.

Never give your Social Security number, bank details or passwords to someone who contacts you first.

Timeline

  1. Incident began (earliest date reported) source
  2. Reported to Maine AG and California AG source
  3. Latest filing, with Maine AG source

Sources

  1. Maine Attorney General Notice filed Dec 14, 2016
    Filed as “Yahoo Inc.” · 2,448,000 Maine residents
    The link opens the Maine Attorney General's archive of notices (2012–2020).
  2. California Attorney General Notice filed Dec 14, 2016
    Filed as “Yahoo! Inc.”
  3. Maine Attorney General Notice filed Feb 15, 2017
    Filed as “Yahoo Inc.”
    The link opens the Maine Attorney General's archive of notices (2012–2020).

Last updated Oct 20, 2026. Our summaries are written in our own words from the official filings above. Spotted an error? Report a correction.