Yahoo says that for potentially (which at a billion, is pretty much everyone) affected accounts, stolen data "may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers.