A threat actor exploited a vulnerability in Yahoo's account log-in process, allowing it to access user accounts without a password. Approximately thirty-two million accounts were affected.