VP Jay Rossiter’s message to stakeholders was missing something important…
Late last month, Yahoo joined the ranks of organizations to have been hit by hackers in 2014. Never good at any time, the fact that the company has already been under fire about an extensive downtime for its Mail service in December, as well as a Flickr outage that left users floundering, means this incident brought an extra dose of reputation damage.
While Yahoo is staying mum on exactly how many were affected, here’s what senior VP Jay Rossiter had to say about the situation in a blog post:
Security attacks are unfortunately becoming a more regular occurrence. Recently, we identified a coordinated effort to gain unauthorized access to Yahoo Mail accounts. Upon discovery, we took immediate action to protect our users, prompting them to reset passwords on impacted accounts.
Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise. We have no evidence that they were obtained directly from Yahoo’s systems. Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts. The information sought in the attack seems to be names and email addresses from the affected accounts’ most recent sent emails.
What we’re doing to protect our users
We are resetting passwords on impacted accounts and we are using second sign-in verification to allow users to re-secure their accounts. Impacted users will be prompted (if not, already) to change their password and may receive an email notification or an SMS text if they have added a mobile number to their account.
We are working with federal law enforcement to find and prosecute the perpetrators responsible for this attack.
We have implemented additional measures to block attacks against Yahoo’s systems.
What you can do to help keep your accounts secure
In addition to adopting better password practices by changing your password regularly and using different variations of symbols and characters, users should never use the same password on multiple sites or services. Using the same password on multiple sites or services makes users particularly vulnerable to these types of attacks.
We regret this has happened and want to assure our users that we take the security of their data very seriously.
For more information, please check our Customer Care help page.
By Jay Rossiter, SVP, Platforms and Personalization Products
While the explanation of steps taken and the re-securing process are easy to follow for even the average user, can you spot the missing ingredient in Yahoo’s crisis communications?
If you said compassion, you’re on the ball. Not once did Rossiter express compassion for the stress, concern and confusion that affected users undoubtedly experienced. He came close with the “regret” statement, but fell short of actually commiserating with his constituents, a mistake that undoubtedly hurt Yahoo’s overall crisis management efforts.
——————————-
For more resources, see the Free Management Library topic: Crisis Management
——————————-
[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is Social Media Manager for the firm, and also editor of its newsletter, Crisis Manager]
Jonathan L. Bernstein, president of Bernstein Crisis Management, Inc. has more than 25 years of experience in all aspects of crisis management – crisis response, vulnerability assessment, planning, training and simulations.
Erik Bernstein is vice president of Bernstein Crisis Management. Erik started with BCM in 2009 as a writer and subsequently became social media manager for the consultancy itself as well as for a number of BCM clients before moving to the VP position.