3 October
What happened on this date in privacy, anonymity networks and censorship. Every year on the same date we add a new look back and keep the earlier ones as they were.
2026
Passwords and security questions in old accounts
If you reuse a password, or the same security questions for account recovery, across different sites, a leak at any one of them puts the others at risk too. On 3 October 2017, Yahoo announced that a breach in August 2013 had affected all of its user accounts. Taiwan's Central News Agency reported the next day that this came to about 3 billion, three times the earlier estimate. Yahoo's FAQ says the stolen information may have included names, email addresses, phone numbers, dates of birth, hashed passwords and, in some accounts, security questions and answers. Names, phone numbers and birthdays are also what doxxers piece together, and our story the same day covers how to guard against that (see Doxxing prevention and incident response). Yahoo advised anyone who had used the same or similar passwords and security questions on other accounts to change them as well.
Also on this day
- On the day of German reunification, the federal government appointed a special commissioner for the personal files of the former East German Ministry for State Security (Stasi). Source: Bundesarchiv
- The Philippines' Cybercrime Prevention Act took effect, and media groups challenged it before the Supreme Court the same day. Source: VERA Files
- The US and UK signed the first CLOUD Act agreement, letting law enforcement in each country, with court authorisation and once the agreement is in force, demand electronic data on serious crime directly from tech companies in the other, though not to target the other country's residents. Source: US Department of Justice