About 453,000 emails sat in the July 2012 Yahoo Voices file — passwords stored in the clear, not the later 3-billion-account incidents. Check whether your address is in this file, then treat any reused password as the first job.
Quick answer — was Yahoo breached?
Yes — but this page is the July 2012 Yahoo Voices / Contributor Network leak of about 453,000 plaintext passwords. It is not Yahoo’s later 2013 or 2014 company-wide breaches. A match means your address appeared in that Voices file. Check if you were affected.
This catalog row is the July 2012 Yahoo Voices leak — not the later company-wide 2013 and 2014 incidents. A group calling itself D33Ds Company said it used SQL injection on a Yahoo subdomain and posted about 453,000 usernames and passwords stored in the clear. Researchers tied the dump to Yahoo Voices (the former Associated Content / Contributor Network). Yahoo confirmed that an older Contributor Network file had been stolen.
The passwords were not hashed. Anyone who opened the file could read them. The list mixed Yahoo addresses with Gmail, Hotmail, AOL, and other inboxes because contributors could sign up with those IDs. Yahoo said fewer than 5 percent of the Yahoo accounts in the file still had a valid password, and that it was resetting affected Yahoo users and notifying other companies. The remaining risk is reuse: a plaintext password from 2012 still unlocks any site that never got a unique replacement.
Troy Hunt’s contemporaneous analysis compared this dump with the earlier Sony breach and found that 59 percent of people who appeared in both files had reused the same password. That is why a 453,000-row Voices file still matters: it is a documented stuffing kit, not a footnote to the later 3-billion-account disclosures. Learn more about what a data breach means for you.
The passwords were not hashed. Anyone who opened the file could read them. The list mixed Yahoo addresses with Gmail, Hotmail, AOL, and other inboxes because contributors could sign up with those IDs. Yahoo said fewer than 5 percent of the Yahoo accounts in the file still had a valid password, and that it was resetting affected Yahoo users and notifying other companies. The remaining risk is reuse: a plaintext password from 2012 still unlocks any site that never got a unique replacement.
Yes, if a password from that 2012 file was ever reused and has not been changed. The dump is old, widely copied, and still useful against leftover logins. This page does not mean “every Yahoo Mail account on earth.” It means this Voices / Contributor Network file. Changing a Yahoo Mail password today does not retire the same string on other sites.check whether your email was exposed in this breach.
Email addresses — used for phishing attacks and credential stuffing against your other accounts
Passwords — can be used to access your accounts directly or cracked to reveal your actual password
11 July 2012
D33Ds Company posts about 453,000 usernames and plaintext passwords it says came from a Yahoo subdomain via SQL injection
12 July 2012
Yahoo confirms an older Yahoo Contributor Network (formerly Associated Content) file was stolen and says it is resetting affected Yahoo users
July 2012
Researchers identify the property as Yahoo Voices; Yahoo says fewer than 5 percent of Yahoo accounts in the file still had valid passwords
July 2012
Independent analysis finds heavy password reuse between this dump and the earlier Sony breach — 59 percent of overlapping users shared a password
2013–2017
Yahoo separately suffers and later discloses much larger company-wide incidents — not this Voices file, and not this catalog row
2012–2026
Copies of the plaintext Voices list remain in stuffing kits; leftover reused passwords still unlock other sites
Yes, if a password from that 2012 file was ever reused and has not been changed. The dump is old, widely copied, and still useful against leftover logins. This page does not mean “every Yahoo Mail account on earth.” It means this Voices / Contributor Network file. Changing a Yahoo Mail password today does not retire the same string on other sites.
Email addresses in a plaintext dump do not expire as phishing targets. A unique password plus two-factor authentication is the work. Learn how long stolen data stays dangerous.
No. Yahoo later disclosed much larger incidents: a 2014 theft affecting about 500 million accounts, and a 2013 theft Yahoo first put at 1 billion accounts and later said reached all 3 billion accounts then on the service. Those events were disclosed in 2016–2017 and led to investor and regulatory consequences. They are a different story.
This lookup slug is the 2012 Voices file. Industry-standard breach data sources list it under the Yahoo name with a July 2012 date and about 453,000 records. The data types on this page are email addresses and passwords. They are not the later mix of names, phone numbers, dates of birth, and security questions from the company-wide incidents.
If you want the later company-wide narrative and whether Yahoo Mail is reasonable to use now, use Is Yahoo safe after the data breach?. Do not treat this page as proof that the 2013 or 2014 files are what matched.
If your address is in the 2012 Voices file, EmailLeaked shows a named Yahoo match the same way it shows any other named incident. The row is a lookup against industry-standard breach data sources. We do not claim an exclusive copy of the D33Ds dump, and we do not crawl hidden markets live.
A match is not proof someone opened your Yahoo Mail this week. It is evidence that the address — and a password stored in the clear — appeared in a file that has been public since 2012. A miss is a snapshot of the records we can search today. We do not keep the address you type into the checker. Hosting logs and a privacy-oriented analytics beacon can still record that the page was visited.
If you want the response order in one place, use what to do after a data breach. If you want to test a reused password without sending the full password, use the password leak checker. For a second public index, see free data breach checkers.
Confirm the match and which Yahoo file it is
Run the email check if you need the named incidents in one list. This Yahoo row is Voices 2012: emails and passwords. It is not a stand-in for the later company-wide Yahoo disclosures.
Check this email — freeTreat any reused password as public
The Voices dump was plaintext. Change the password on email and on every site that shared it. Then check whether that password appears in known leaks without sending the password itself.
Turn on two-factor authentication
Start with the inbox that still uses that address — Yahoo Mail if you still have it, otherwise the provider you moved to. An authenticator app is stronger than a text-message code.
Follow the after-breach playbook
Use the first-hour and 24-hour lists, then the password playbook. Walk the account security checklist so recovery email, sessions, and leftover logins get a pass.
Open the after-breach playbookRead the later Yahoo incidents separately
The 2013 and 2014 company-wide thefts are not this catalog row. The safety guide covers that history without folding it into the Voices file.
Open the Yahoo safety guideClose leftover Yahoo Mail if you no longer use it
Deletion does not unsay the Voices file. It stops an old recovery inbox from sitting in stuffing lists. Do not close it until another inbox can receive those resets.
How to delete your Yahoo Mail accountBreach pages are built from structured breach records and reviewed for practical risk guidance by EmailLeaked. Risk labels reflect exposed data types and are intended to help readers prioritise action.
Sources
Last updated: September 2026
Other major breaches
Check if your email appeared in the Yahoo breach and 1033+ other known breaches — free, instant, no signup.
Check my email — freeCheck if your email is compromised in seconds. Free, private, no signup. Scan millions of breach records across 1034+ known breaches.
Check my email now — it's freeNo signup required · Results in under 5 seconds · Your data is never stored
