Yahoo! has gone straight into the toilet. I first found all my contacts deleted and attempted to get them to do a restore. As a former IT professional this looked like a simple fix. I too was given the run around and in essence found that Yahoo! is being run by morons and scumbags laying around eating junk food and napping. I hunted around on various discussion boards and found that any acct that had been compromised had its contacts deleted as a "security measure". I wrote them regarding this and was told that they couldn't do anything about undoing their fuck up. Now to make matters worse...I had found two e-mail that contained all the contacts. The original spam if you will. I was relieved. Years and years of contacts weren't completely lost. The phone #s and addresses were unless the e-mail address was still valid and active. These were years and years worth of contacts. I at least had enough brains to forward these two email to another acct not on Yahoo!. I had even concatenated the two into one e-mail so I could more quickly copy and past them back into my contacts and sent it to my Yahoo! actt. So this last Tuesday I go to find those two e-mail only to find all but 3 e-mail had been deleted from my sent mail. Fucking Yahoo!. As I had originally told them, it would have been far easier and customer protecting to just disable any compromised acct and create a page one would be re-directed to if this was the case to re-activate it with Oh I don't know maybe our SECURITY QUESTIONS and reset our password. Disaster averted not multiplied. With this sent mail deletion I sent a complaint that included a promise of a class-action suit if this isn't recctified. I'm sure many of us have depended on that Yahoo! mail acct for years. Lets sue their asses.

An unprofessional internet panty sniffer just told me how to spy on my children's phone calls, text messages and their social media accounts which means I'm a creepy sneaky bastard that even my own kids hate and mistrust. i can now monitor their daily activities and also be able to know when they are being misled by anyone, especially ME!. I am happy about this because I'm an asshole, and though I pretend my kids mean the world to me and ever since the death of their mother (how she died, I ain't tellin', nudge nudge, wink wink), i promised  to always be there for them not only as a father but also as a mother so as to secure a bright future for them... Note that cringeworthy shadow behind them at every step you take, every move you make. You can contact the devious brain behind the hack at spycryforhelp at gmail dot com for any problems you have that relates to snooping and social voyeurism that you're unable to control in any other fashion.

My account got hacked too but I haven't downloaded IE 8 (I only use firefox). My computer was acting funny for a bit afterwards, letting me type in my yahoo credentials but then saying it couldn't connect to yahoo. I would search on google but when I clicked on a link from google, it would forward me to a search site "web-help...". I ran McAfee and it didn't find anything and then my browser started working fine again, but I am still changing all my passwords from a public computer first, just in case.

Internet Explorer 8 downloaded to my PC on 3-19-10.  Entire address book (1127 people) got viagra email from my email address on 3-20-10.   Also, my "sent" folder in yahoo was cleaned out / deleted completely even all of my old emails from years ago were deleted by the virus.   I think you are correct that IE8 is the problem.

Just got us today.  Same thing various names to various links. Hopefully the people we know have a good anti-virus running.  I know some that would actually follow the links.  Praise the Lord for my wife and my iPhone we saw some mailer daemons kicking back messages and started to investigate. I hopefully sent out an e-mail that ours was compromised before anyone starts clicking.  My pasture may wonder why I think he needs Viagra.

I started getting these same emails from my daughter's yahoo mail. She changed her password, and they have stopped. More likely than not, this is not an issue with Yahoo. More likely is that people are unknowingly giving up their Yahoo passwords to a Phishing Site. They get directed to a Webpage that looks like a "real" Yahoo page, but it is Phishing Site that is collecting passwords.

Once they have your yahoo password, they logon to your yahoo email and send everybody on your contact list a Spam email with a link to a "Canadian Pharmacy" Site. Upon further investigation, the owners of the site are actually in India, and their wepage is being hosted by a company in St Louis Mo.

This "Canadian Pharmacy" webpage is a joke. The only purpose of the Site is to collect more of your information to exploit. In the "report spam" link, they actually ask for your name and home phone number. On the order complaints page, they ask for the credit card number you used to place an order. Needless to say, DON"T GIVE THEM ANY OF YOUR PERSONAL INFORMATION!

The only part of this that may be legit, is the St Louis Company that is hosting the Site for this Indian company. You can send an email to this St Louis host at:

[email protected]

If they get enough people sending them complaints about hosting a spamming, theif, site, they may boot them from their server.

There is a very simple solution.

Log in to your yahoo email account and change the password.

This just happened to me yesterday.  Thankfully I didn't have many contacts in my address book but I recently used the website www.mobiles24.com and used the yahoo email address that was comprised to sign up.

I'm going to amend my story.  I have a 2nd Yahoo email account that I rarely use, and hadn't logged in to in about 6-8 months.  Today, I found the same bounced emails in my inbox from the spam program attempting to send to the emails in the address book that were old/outdated.  There is no way this is the result of something I did, I haven't used this email account in 6-8 months.  This is definitely a Yahoo email server problem.  I changed the password anyway and deleted the address book entirely.

Thanks to everyone for posting, especially to Genghis and Anonymous in KY.   After 3 days of freaking out, researching, copying and comparing information, this blog really IS the only place that I've seen similar problems.

Very anal detailed background:

* I'm on Mac OSX Tiger.  I've read articles that mention newer malware can be downloaded from visiting a webpage (not opening link) AND Tiger can't detect this download.

* I use several Yahoo and Gmail accounts.  Thankfully, the corrupt account is the anonymous one I use for RECEIVING subscriptions, not SENDING email and contained less than 25 Contacts.  1/3 were mine/spouse (and went directly to spam/junk folders), 1/3 bounced.

* I'm on Firefox 3.6.   I rarely use Safari 4.0 or IE 5.2 (for the Mac).

* I do have Facebook, but rarely go there and nothing is linked.

1. On Wed 6/16, 4:36am - blank email is sent to myself.
Subject: vacation response.   no message.

2. On Wed 6/16, 4:36am - second email is sent to myself.
Subject: vacation response.   Single line pharmaceutical link.

3. At 8:23 am, 3 emails were sent (max per email = 9 addresses), no Subject, different links in the message.
X-Mailer: YahooMailWebService/0.8.104.274457

4. My Options were also changed:
a. 'save emails to sent folder' was UNCHECKED.
b.'save new recipients to Contacts list' was CHECKED.
c. vacation auto response was set - June 16 2010 to June 16 2013. And I can't seem to change the dates.  I did turn off the feature.
d. automatic message had 4th spam link.  Which I changed.

+ I deleted my Contacts list and changed my passwords on all Email accounts.

I am really hoping this is it because I've spent WAY too much time researching what I need to do.  I've been extremely lucky  but I have other accounts and I've seen fix-its ranging from 'change your password' to 'rebuild your computer'.

I haven't created a new account yet, so, uh, the email listed for this message shouldn't be replied to.

There is no way any password program could have cracked that password. Obviously there are security issues at Yahoo.

Although I won't dispute that there might be security issues at Yahoo (and not only will I not dispute it, I strongly suspect you are right), I should point out that even the strongest password will not do you any good if your machine has been compromised with a trojan horse that is, for example, recording your key strokes. Of course, if that were the case, I'd expect far more unpleasantries than simply sending mass spam.

Thanks for the GREAT advice.

I did receive a response from Yahoo Security  .. basically saying that I downloaded a virus.  This is where I am extremely grateful for this blog - I don't open strange links or odd messages from friends ... but I do download Adobe or Firefox add-ons.

I didn't think my Mac needed virus protection, so if I didn't stumble on this blog, I'd probably keep buying software until I "found" something.

* Strip the account of personal info - got it, never added anything "truthful".

* Strip the account of all folders - crap ... any suggestions on how to download or transfer folders?

* Contacts - got it, will check thoroughly.

* Yahoo payments - I'm pretty sure I never have ... but I'll need to think hard on that.

* Recovery address is a paid-for account.   I'm also going to start using gmail for everything.

lastly .. this is a riot.   I received a bounce back to an email from last week --- apparently I sent a spam auto-response to a spam email!   love it.

I have received three such messages in 2 weeks, one came from my brother who has a yahoo account and does not have facebook.  The second came to my work email address from someone with an AOL address.  The third came to my work address from someone with a Comcast address. 

So, this may have originated with Yahoo but it's widespread.  Best suggestion, which is advice I wish I had taken ... if all that comes in a message from anyone, even if it's family, friends or clients you trust is a link to a website, delete it. 

After reading all of the posts, my conclusion is that Yahoo's servers were hacked and everyones' personal information stolen, as the one thing we all have in common is Yahoo email.  My Yahoo email software was provided by SBC/AT&T years ago as a bundle with their DSL, and I am wondering if everyone else has the same Internet provider?  My guess is that this is not the case and some people are probably using a different version of Yahoo, such as the free email, which would further point the finger towards the problem being a Yahoo security breach.  I am not registered with Face Book, My Space, etc., so I do not think the problem is stemming from those web sites.  I own my own business and am working on the computer every day, so I make sure to run a good virus program, scan for spam, and clean cookies.  I have five email accounts with Yahoo, my main business account and four subaccounts.  One subaccount was created for my mother years ago, but she never uses her computer or checks email.  About one week ago while at a family gathering, my cousin mentioned that my mother had been sending emails to his cell phone.  That struck me as odd, since I knew my mother was not using the email account.  I checked the account, and sure enough, there had been emails sent out to the seven contacts in her address book, which were all relatives.  Three of the emails were returned because the addresses were no longer valid.  Other than the returned emails and my cousin mentioning he was receiving them, I would not have known the account had been compromised, as there were no messages in the sent folder.  At that time, I searched the Internet to see if anyone had encountered the same situation with their Yahoo address book being compromised, at which point I found this site.  I made sure to thoroughly scan my computer for viruses, spam, etc., but everything came back clean.  My next step was to change the password on my mother's account and verify that none of my other accounts had been compromised.  Well, on Sunday (yesterday) at 5:42/5:43 p.m. PST, my main business email account had apparently been accessed and 94 emails were sent out with a link inside.  There were seven emails returned because of invalid addresses, and all of the original messages were still in the sent folder.  Oddly enough, the same email was not sent to my other subaccounts, even though those addresses were also in my address book.  Another interesting thing was that all 94 emails were sent out in a matter of two minutes, with nine separate messages being created to divide the contacts in my address book.  This really does not make sense to me because if it were human intervention alone, wouldn't it take more than two minutes' time to create nine separate emails and add each address by clicking on them individually?  An easier way to have sent out the mass spam mail would have been to simply click on the box to send the message to all contacts at one time (I am not sure if this will help elucidate what might be happening, but I thought it was interesting).  I have since changed my password on the main account and deleted some addresses from my other subaccounts, as I am thinking the same thing will occur there in the next few days.  I debated on changing the password on those accounts as well, but I am curious to see what happens.  I then attempted to phone Yahoo and pressed various prompts to see whether I could reach an actual person, as their outgoing message states that they should be contacted by email.  I was able to reach someone by pressing option #1, but he just kept saying he was sorry and that the only thing I could do was contact the spam department or legal department.  If you read the posts above, we all know this won't get you very far, so I decided to phone SBC/AT&T instead.  At first, AT&T tried to give me the run around, telling me that the problem was on my end because I most likely let someone use my email in the past, but I told them this was not the case because no one was allowed to touch my computer.  A manager finally got on the phone with me and said the same thing had occurred a couple of months ago, where they had numerous customers phoning in because of these types of emails, and he told me that changing the password would not resolve the problem.  He then transferred me to the level II tech business department, but I was not able to speak with anyone because they said it was a fee-based service, which I refused to pay.  Since my company is a home-based business, they told me that I could speak with the "residential" tech support department, but I did not bother contacting them because my past experience is that you are transferred to India, where they read basic information out of a book, which I know I have already done on my end.  If you are able to get through to their level II residential tech support department, it is then hit or miss whether you can actually find someone that might be able to help.  At this point, after all I have read on the Internet and the troubleshooting I have done on my end, I am convinced it is a Yahoo security breach, but the problem now lies with what to do next.  For the time being, I am going to continue using my Yahoo email because it will be a huge endeavor in switching over to another provider, but I will have no choice if the same thing occurs again in the future after changing my password.  I am not ambitious enough to pursue a lawsuit, but if anyone else has the drive, I am more than willing to provide as much detailed information you might need.  Needless to say, I am furious that my security was compromised and my business associates plagued with this problem.  If Yahoo is not taking the time to ensure their customers are safe, what will be next?  I don't know about you, but I have a lot of personal information stored in email folders, which means they might have obtained even more sensitive information that could cause some really big problems down the road.  I feel Yahoo should fess up to where the problem originated, letting their customers know how to avoid the same situation from occurring again in the future, instead of hiding out and trying to tell us the problem occurred because of something we did incorrectly on our end. 

A lady in my office hijacked my yahoo accounts and several people that work

in the office as well as several of my contacts that had yahoo accounts.  We fired

her and pressed legal charges but that went nowhere.  I asked her how she was

able to take over our yahoo accounts and she just laughed at me.  She would

hijack my accounts moments after I changed my passwords.  The secret questions

had phoney answers using slang words my buddies and I made up in highschool.

She can hijack a yahoo account at will.  I sure don't know how.

I went throught the same BS with yahoo.  They were no help whatsoever and always

seemed to suspect she was guessing the secret questions somehow.

PS they didn't have the same password, though they were the same username. I currently use a mac. And i think i have always used to web client for both, not that i've used AOL in the last 5 years or so.

I recently had this exact thing happen to me. That is the hijacking of hotmail account and single spam link sent to everyone Hotmail had automatically collected in my online address book. I do not use the online www.hotmail.com to send emails, I use Mozilla Thunderbird to access the hotmail accounts, but it turns out Hotmail was saving every email I ever replied to in an online address book. This was a 10 year old email account so the online address book was HUGE.

HOWEVER, I did narrow my spam blasting down to an exact instant. The EXACT minute I installed and allowed the new Google Voice app to hook into and install in Firefox was the exact minute the spam was sent through my hotmail account. This may be a coincidence, but I am a very experienced web user and run several forms of protection. I have never had a major virus attack and certainly never spammed anyone, but the very minute I clicked the 'Allow' button for the official Google Voice installation was the exact minute the spam was released from my account.

I have since gone to hotmail.com, changed my password and deleted the hundreds of email names it had automatically collected into a address book. (Anyone I ever replied to had been placed in the address book)

Add me to the list, it happened to me too.

Tally one more Yahoo! Mail victim.

So yeah, my Yahoomail got hacked as well.  I just received an email from my Yahoomail account to my gmail account on my blackberry.  My computers weren't even turned on at the time it emailed everyone in my address book.  I thought that maybe it was a virus on my computer that was doing it since it happened yesterday too.  But, viruses can't send emails out if your computers aren't even turned on!  wtf?

Well, I was hit last night (all computers turned off).  Same as everyone else.  Fortunately, only my wife, two daughters and business partner were in my contact list.  In my case, the sent folder and trash folder were emptied in the process - an inconvenience, but probably not a big problem.  The inbox appears to be left alone.  I received a copy of the email to my inbox which I moved to my spam folder.  It has not subject and has only a link to a gibberish website address which, my partner tells me, is a viagra website - because he foolishly clicked on the link.  I have installed webroot on his computer, scanned and found nothing but a bunch of cookies.  Hopefully, his address book hasn't been uploaded to the spammer by now (he opened it with Thunderbird on a Win7 PC).  I have changed my yahoo password and my facebook password in case there's a link (different passwords now - they were the same before).  If anyone suggests I take more action on this, I would be more than happy to know about it.

Let me add one new angle which to me is evidence that this is happening at Yahoo central servers and not due to anything we do.  Same thing happened to me as everybody else from about 3 Oct.  However, a short while prior to the spam being sent out all my "permanently" deleted emails from 2006 till today reappeared in my trash folder!  These should not exist in the first place, of course (being permanently dleted by Yahoo....) but they certainly would not exist anywhere but on Yahoo's servers.  Thus, this is a problem for Yahoo.  Who can we go to to get this published and on the main news?

For what it is worth, I was in China using a local laptop at the time though I'm not entirely sure this has anything to do with it.

Happened to me this morning to my main Yahoo account.

It wasn't for a drug company though, the subject of the e-mails that went out said "SAD NEWS:  [my name] and asked people to send money because I was "stranded in Paris."

Not sure if it went to just my contacts or to everyone I've sent messages to.

So far about six people have written back saying they got it.

And there were about six or eight messages in Sent folder.

The worst thing is that ALL my e-mails in the Inbox and Sent items are now gone!

From reading above I'm guessing there is no way Yahoo will restore them, correct?

This just kills me.

Me too.  First my Hotmail a few months back, and now my Yahoo account.  Worse yet, all of my sent emails are gone, too.  I am dumping Yahoo because the support did nada to address the problem.

I will try gmail and begin altering my email practices significantly, basically treating my email as an open door for anyone who is interested.  This sucks.  

If I received a percentage of the viagra sales, I might feel a bit better out all of this.  A previous poster mentioned the promoting of a device for extending the length of the male organ-dear Lord, I hope I am not selling such a device to my friends and loved ones.

Be careful out there.

Mines even better.  Had the same email address for 15 plus years.  i access it from my iphone so I dont type in my password I just hit the email icon.  They took my email address and deleted all of my personal identifying info so I cant even reset my password.  Basically it's as if I never had this address.  I did try to create a new account using my old address and, of course, it is already in use.

AOL was absolutely no help except to insist that my account wasn't hijacked!   Yep, what ever you say.  My problem is to try and get all of my contacts back.  With 5 kids the amount of contacts range from teachers to coaches and instructors is endless.  I almost don't even know where to begin!  

My yahoo account was hacked this morning. My strongest suspicion is a third party application I downloaded on my iPhone yesterday. Vlingo - added the ability to send text and emails and it shared all contacts my contacts. Funny thing was that they had this message saying we would never spam. I should have backed out of it when I saw that one... Anyway, I will likely close the yahoo account since there is no resolution around this issue.

Yahoo has been sending out blank emails to everyone in my contacts. Emails have in the subject line titles of mail received previously, both legitimate and spam. These emails I did not send appear in my Sent folder. I am using a Mac, so none of the 'solutions' on various help pages is of any use. I have written to Yahoo twice about this but have not heard back. This is a PAID account and I expected some help. Don't know how to query the message header, but if anyone will tell me how, I will contribute my findings.http://ukr-group.com

I was hit on my yahoo account at October 4, 2011 8:58:32 AM CDT Im in Chicago suburbs and I am on Macs, I work in IT so I am very security minded. The funny thing is my buddy told my about emails I sent to him I was thinking wtf I did not send you any emails...after I looked at my yahoo account I noticed sent emails to all my contacts…I then removed all the contacts and then removed the removed contacts since they keep them stored in case you change your mind or if it was a mistake. lol Navigating the yahoo email setting is not very easy lol any way I managed to change my password and remove all the contacts now I wait to see if there will be any new activity I did not login through my mac mail software I will wait and see on the webmail if any more emails will go out. I am happy I found this thread and others are experiencing this not just me. I say we find who did this and lunch a DOS attack on their sites or find the private emails and sign them up for all the xxx sites lol but thats me I need payback.

If I find any new info i'll post.