Yahoo shouldn't be doing the attribution, it's a conflict of interest[0]. At the moment the standard for incident disclosure is "eventually disclose the leak t

Yahoo shouldn't be doing the attribution, it's a conflict of interest[0]. At the moment the standard for incident disclosure is "eventually disclose the leak to users", which some companies, like Yahoo in this case, really stretch. I'd like to see the standard become engaging an outside firm and have them release as much information as possible so that the techniques used, information stolen, potential attribution etc. can be reviewed and benefit everybody. The statement so far from Yahoo benefit only Yahoo (specifically Yahoo management) The stolen Yahoo accounts were listed on a DNM market a few months ago. That is how we found out about it (I suspect that is also how Yahoo found out about it). That is one of the only data points we have on the outside and it points away from the attack being state-sponsored. [0] Some would argue that the research / attribution firms are only a little less conflicted since they sell products that aim to prevent the same state-sponsored attack.