Anybody know more about Yahoo email breech?

Mac's are not usually subject to these things, but they are also not infallible. This sounds like a mail bot, because that's what they do. Blaming Yahoo is the easy way out. They do provide all the protection they can, but ultimately, protecting your computer and your email is your responsibility. The one suggestion I have seen, over and over, is close the account, move the contacts one by one, so she might skip the infected one, and she most likely has at least one infected contact.