Fact-checked by Grok 2 weeks ago

Yahoo data breaches

The Yahoo data breaches involved two principal cyber intrusions into the company's systems in 2013 and 2014, compromising personal information from all three billion user accounts and establishing the incident as the largest known data breach in history.^[1]^[2] Attackers, including Russian Federal Security Service (FSB) officers, extracted usernames, email addresses, telephone numbers, dates of birth, hashed passwords, and security questions and answers, though payment card data was generally not accessed.^[3] These breaches remained undetected for years due to inadequate security measures and monitoring at Yahoo, with the 2013 event affecting the entirety of active accounts and the 2014 attack targeting an additional 500 million.^[4]^[5] U.S. authorities charged FSB operatives Dmitry Dokuchaev and Igor Sushchin, along with hackers Alexsey Belan and Karim Baratov, for orchestrating the operations, which involved stealing core databases and minting authentication cookies to enable persistent access.^[3] The delayed public disclosures in 2016 and 2017, prompted by Verizon's acquisition scrutiny, reduced the purchase price by $350 million and triggered regulatory fines, class-action lawsuits, and widespread criticism of Yahoo's cybersecurity practices under CEO Marissa Mayer.^[6]^[7] The incidents underscored vulnerabilities in large-scale internet services to state-sponsored espionage, as stolen data facilitated targeted surveillance of government officials, journalists, and executives, while exposing users to phishing, identity theft, and account takeovers without immediate remediation options like password resets for affected legacy accounts.^[3]^[5]

Breaches and Vulnerabilities

August 2013 Breach

In August 2013, Russian Federal Security Service (FSB) officers and their criminal accomplices accessed Yahoo's network, compromising user account information.^[3] The intrusion involved exploiting vulnerabilities to steal data from Yahoo's systems, part of a broader conspiracy targeting millions of email accounts across multiple providers.^[3] The breach affected all approximately three billion Yahoo user accounts active at the time, marking it as the largest known data compromise in history.^[8] Stolen information included names, email addresses, telephone numbers, dates of birth, hashed passwords, and security questions and answers, though no unencrypted passwords, payment card data, or bank account details were taken.^[8] Yahoo initially underestimated the scope, disclosing in December 2016 that over one billion accounts were impacted before revising the figure to three billion in October 2017 following further investigation.^[8]^[9] United States authorities attributed the hack to FSB Unit 71330, charging officers including Dmitry Dokuchaev and Igor Sushchin, along with Canadian hacker Karim Baratov, who provided access in exchange for payment.^[3] The FSB actors reportedly used the data for intelligence purposes, such as identifying targets for surveillance and disrupting investigations into Russian cyber activities.^[3] Yahoo detected indicators of the breach years later, with the full extent uncovered only after Verizon's acquisition review in 2016 prompted deeper forensic analysis.^[8]

Late 2014 Breach

In late 2014, unauthorized actors accessed Yahoo's network and stole personal data from at least 500 million user accounts.^[10] The compromised information included names, email addresses, telephone numbers, dates of birth, MD5-hashed passwords, and either encrypted or unencrypted security questions and answers.^[11] ^[12] Unlike the earlier 2013 incident, this breach did not appear to involve the theft of unencrypted passwords or credit card details, though the exact scope of protected data access remains partially unclear.^[1] Yahoo publicly disclosed the breach on September 22, 2016, two years after its occurrence, attributing it to a state-sponsored actor.^[10] Subsequent U.S. Department of Justice investigations linked the intrusion to Russian Federal Security Service (FSB) officers, including Dmitry Dokuchaev and Igor Sushchin, who allegedly directed hackers such as Alexsey Belan to penetrate Yahoo's systems.^[13] The attackers reportedly used techniques such as spear-phishing to gain initial access, enabling them to exfiltrate authentication credentials and user data over an extended period.^[14] The breach highlighted vulnerabilities in Yahoo's perimeter defenses, including inadequate monitoring and segmentation, which allowed persistent access without timely detection.^[15] No specific software exploits were publicly detailed by Yahoo, but the incident involved compromise of proprietary tools used to access private user content, amplifying the potential for targeted espionage.^[1] This event, combined with the prior breach, contributed to significant erosion of user trust and financial repercussions for Yahoo's valuation during its acquisition by Verizon.^[4]

Technical Methods and Exploited Weaknesses

The 2013 Yahoo data breach, affecting all three billion user accounts, involved hackers exploiting weaknesses in Yahoo's data storage and authentication systems, primarily through the theft of unencrypted or weakly protected user data fields. Attackers accessed usernames, email addresses, phone numbers, birthdates, hashed passwords using the outdated MD5 algorithm, and plaintext security questions, which were not adequately salted or encrypted to prevent cracking.^[16]^[17] MD5's vulnerability to rainbow table attacks and brute-force methods allowed potential decryption of passwords, as the hashing lacked modern protections like bcrypt or scrypt, reflecting Yahoo's reliance on deprecated cryptographic practices despite known risks since the early 2000s.^[17] In the separate late 2014 breach impacting over 500 million accounts, Russian state-sponsored actors, including FSB operatives, initiated access via spear-phishing targeting a Yahoo employee's credentials, enabling initial network foothold.^[18]^[19] From this entry point, intruders exfiltrated proprietary source code used for generating user authentication cookies, allowing them to forge valid cookies and impersonate users without passwords or multi-factor authentication.^[18]^[16] This bypassed Yahoo's login mechanisms, exploiting insufficient code segmentation, weak access controls on internal repositories, and absence of runtime integrity checks, which permitted lateral movement to compromise over 6,500 additional accounts.^[19] Both incidents highlighted systemic weaknesses in Yahoo's perimeter defenses and internal segmentation, including inadequate employee training against phishing, lack of least-privilege enforcement for developer tools, and delayed patching of known vulnerabilities in web applications.^[18]^[20] No evidence of zero-day exploits emerged; instead, success stemmed from social engineering combined with technical lapses in encryption and code protection, enabling data exfiltration without detection for months.^[4]

Organizational Security Context

Pre-Breach Security Culture and Practices

![Marissa Mayer, CEO of Yahoo from 2012 to 2017][float-right] Yahoo's pre-breach security practices were marked by the use of deprecated technologies and a corporate emphasis on user experience over robust defenses. Prior to the August 2013 breach, the company employed MD5 hashing for password storage, an algorithm vulnerable to brute-force and collision attacks and abandoned by security standards years earlier.^[17]^[21] A project to migrate away from MD5 toward stronger methods like bcrypt began only in summer 2013, too late to prevent the initial intrusion.^[21] Two-step verification was introduced for Yahoo Mail in December 2011, providing an optional layer of protection via secondary codes sent to mobile devices.^[22]^[23] However, it remained voluntary, with low adoption rates among users, and was not extended comprehensively across services or enforced for sensitive operations.^[22] Under CEO Marissa Mayer, appointed in July 2012, Yahoo prioritized mobile product development, content acquisitions, and revenue growth amid declining market share, often deferring security hardening requests.^[24] Internal proposals for measures like widespread password resets were rejected around 2014 to minimize user friction, reflecting a culture that weighed convenience against potential risks.^[25] The security team reportedly faced denied resource allocations for upgrades, underscoring insufficient investment in threat detection and vulnerability remediation relative to business imperatives.^[24] This approach perpetuated legacy systems susceptible to forged authentication cookies and unencrypted data fields, as exploited in the breaches.^[4] Post-incident analyses by experts highlighted Yahoo's failure to adopt industry best practices proactively, such as regular audits and encryption of security questions, contributing to the scale of the compromises.^[26]^[27]

Earlier Yahoo Breaches as Indicators

In July 2012, hackers compromised Yahoo's Voices platform, a user-contributed content service, exposing approximately 450,000 usernames, email addresses, and passwords stored in plaintext or weakly protected form on a vulnerable database server.^[28]^[29] The breach, claimed by a group identifying as "D33DS Company," exploited a SQL injection vulnerability, allowing the extraction and public dissemination of the data file online.^[30]^[31] Yahoo confirmed the incident and initiated an investigation, resetting affected passwords and notifying users, but the event highlighted deficiencies in basic security hygiene, including inadequate encryption of sensitive credentials and unpatched web application flaws.^[28] This 2012 incident served as an early warning of Yahoo's entrenched security shortcomings, yet the company failed to implement comprehensive reforms that might have mitigated subsequent larger-scale compromises.^[32] Post-breach analyses revealed persistent issues such as reliance on outdated practices and insufficient investment in defensive measures, which persisted into 2013 and 2014 when state-sponsored actors exploited similar weaknesses to access billions of accounts.^[33] The Voices hack demonstrated how third-party or subsidiary services could expose core vulnerabilities, but Yahoo's response emphasized isolated fixes rather than enterprise-wide hardening, including multi-factor authentication or advanced monitoring, allowing attackers to probe and succeed in deeper intrusions later.^[34] Further indicators emerged from the breach's aftermath, where exposed credentials enabled credential-stuffing attacks on other services due to password reuse—a risk Yahoo did not aggressively address through user education or policy enforcement.^[35] Independent security firms noted that the incident reflected a broader cultural lag in Yahoo's engineering priorities, favoring product development over robust cybersecurity amid competitive pressures in the early 2010s.^[32] These unheeded signals contributed to a pattern of undetected persistence by adversaries, as evidenced by forensic reviews of the 2013 breach, where tools and access methods akin to those in 2012 went unnoticed for years.^[33]

Investigations and Disclosures

Internal Detection and Response Efforts

Yahoo's security operations center detected unauthorized access in user accounts in late 2014, attributing it to a state-sponsored actor from Russia who had compromised proprietary source code for Yahoo Mail and stolen credentials for at least 500 million accounts.^[36]^[37] The intrusion involved forged cookies enabling account access without passwords, but initial internal assessments underestimated the full scope, with some employees aware of the breach yet failing to escalate findings adequately due to breakdowns in communication and reporting protocols.^[38]^[39] In response, Yahoo's engineering and security teams initiated forensic analysis, confirming the theft of names, email addresses, phone numbers, birth dates, and security questions, though encrypted passwords were not cracked at the time of detection.^[10] However, senior executives, including then-CEO Marissa Mayer, did not prioritize comprehensive remediation or internal disclosure, leading to an independent board committee's later finding of "failures in management, inquiry, and internal reporting" that hindered effective containment. This delayed broader system-wide audits and proactive measures like enhanced monitoring, exacerbating vulnerabilities. The 2013 breach, affecting all three billion accounts, evaded real-time internal detection entirely, with no evidence of contemporaneous alerts from Yahoo's security infrastructure despite the hackers' use of unencrypted data and weak authentication exploits.^[40] Discovery occurred retrospectively in 2016 during Verizon's due diligence for the acquisition, prompting Yahoo to commission external forensics that revealed the full extent, including stolen names, emails, and unencrypted security questions from August 2013 intrusions.^[41] Response efforts then focused on revising initial disclosures—from one billion to three billion affected accounts—and implementing belated improvements, though critics noted the absence of robust anomaly detection tools had allowed prolonged undetected exfiltration.^[4] Post-detection for both incidents, Yahoo formed an independent special committee in 2016 to probe timelines and lapses, which uncovered siloed information sharing and inadequate breach simulation testing within the security team.^[42] These findings underscored systemic issues, such as reliance on legacy systems without multi-factor authentication enforcement, contributing to ineffective initial responses despite the team's eventual cooperation with law enforcement on hacker attribution.^[12]

Timeline of Public Revelations (2016-2017)

On September 22, 2016, Yahoo disclosed that state-sponsored hackers had accessed personal information from at least 500 million user accounts in a breach occurring in late 2014, with stolen data including names, email addresses, telephone numbers, hashed passwords (using bcrypt), and security questions.^[10]^[43] The company stated it had been notified of the incident by law enforcement earlier that month and believed no accounts were accessed post-breach without authorization.^[10] On December 14, 2016, Yahoo announced a separate incident from August 2013 in which an unauthorized third party stole data associated with more than 1 billion user accounts, comprising names, email addresses, telephone numbers, hashed passwords (primarily MD5 with some bcrypt), and unencrypted security questions and answers.^[16]^[44] Yahoo indicated the breach was distinct from the 2014 event and that it had compelled a third-party seller of the stolen data to remove it from circulation.^[16] On October 3, 2017, following its acquisition by Verizon, Yahoo's parent company revised the scope of the 2013 breach upward, stating that all three billion accounts then in existence were likely compromised, exceeding the prior estimate of one billion.^[45]^[8] The update clarified that while not all data was viewed or stolen for every account, the intrusion affected the entire user base at the time, with potential verification challenges due to data duplication and inactive accounts.^[45]

Legal Accountability

Prosecutions of Hackers and State Actors

In March 2017, the United States Department of Justice indicted two officers of Russia's Federal Security Service (FSB), Dmitry Dokuchaev and Igor Sushchin, for directing and facilitating the 2014 Yahoo data breach that compromised over 500 million user accounts, as well as related intrusions into millions of other email accounts.^[3] The charges included conspiracy to commit computer fraud, hacking, economic espionage, and money laundering, alleging that the officers protected, paid, and tasked criminal hackers with stealing user data to target Russian and U.S. government officials, journalists, and others for intelligence purposes.^[3] Neither Dokuchaev nor Sushchin faced extradition or trial in the U.S., as they remained in Russia; Dokuchaev was subsequently arrested in Russia on unrelated treason charges in December 2016 but was not transferred to American custody.^[3] The FSB officers collaborated with freelance hackers Alexsey Belan, a Russian national previously indicted for earlier Yahoo intrusions in 2012 and 2014, and Karim Baratov, a Canadian-Kazakh hacker-for-hire.^[3] Belan, who had infiltrated Yahoo's network multiple times to exfiltrate source code and user data, was charged anew in 2017 with conspiracy and aggravated identity theft but evaded capture and remains at large, having fled to Russia after prior U.S. charges.^[3] Baratov, arrested in Canada on March 14, 2017, following a U.S. extradition request, pleaded guilty in November 2017 to nine felony counts, including conspiracy to hack and unauthorized access to protected computers, admitting he provided the FSB with access to at least 11,000 Yahoo and Gmail accounts between 2010 and 2017 for payments totaling hundreds of thousands of dollars.^[46] On May 29, 2018, Baratov was sentenced in the U.S. District Court for the Northern District of California to 60 months in prison, a $250,000 fine, and forfeiture of assets including luxury vehicles and cryptocurrency, reflecting his cooperation with authorities which provided evidence against the Russian conspirators.^[47] These prosecutions highlighted challenges in attributing and holding state-sponsored actors accountable, as the Russian government's non-cooperation prevented trials of the FSB officers, leaving the case reliant on the conviction of peripheral non-state hackers.^[3]

Regulatory Sanctions on Yahoo

The U.S. Securities and Exchange Commission (SEC) levied a $35 million civil penalty against Altaba Inc., the entity formerly known as Yahoo! Inc., on April 24, 2018, to settle charges that Yahoo misled investors by failing to disclose a 2014 data breach compromising data from over 500 million user accounts.^[48] Yahoo had detected state-sponsored intrusions into its network by July 2014 and confirmed the breach's scope by December 2014, yet executives determined it was not material for disclosure in SEC filings or public statements, despite describing cybersecurity threats and mitigation efforts in those documents.^[49] This omission violated antifraud provisions of federal securities laws, as the breach represented a material cybersecurity incident that increased risks to Yahoo's business and reputation.^[48] The SEC cease-and-desist order marked the agency's first enforcement action targeting a public company's failure to disclose a cyber incident affecting investors, emphasizing that such events must be evaluated for materiality under Regulation S-K, which requires reporting events reasonably likely to impact financial condition or operations.^[48] Yahoo's internal assessments downplayed the breach's significance, attributing non-disclosure to its containment without ongoing harm, but the SEC found this reasoning flawed given the breach's scale—enabled by exploited vulnerabilities like weak authentication—and potential for data exploitation.^[49] Post-disclosure in September 2016, after Verizon's acquisition announcement, the revelation prompted a $350 million price reduction in the deal, underscoring the information's materiality to investors.^[48] No equivalent monetary penalties emerged from other regulators directly targeting Yahoo's breach handling. The U.S. Federal Trade Commission (FTC) scrutinized the incidents but pursued no enforcement against Yahoo, focusing instead on related hacker prosecutions.^[50] In the European Union, Yahoo's lead data protection authority conducted a 2017-2018 investigation under pre-GDPR directives, resulting in orders for enhanced privacy controls and monitoring but no fine, as the breaches predated stricter EU rules.^[51] Canadian regulators similarly imposed no penalties on Yahoo, with actions limited to criminal proceedings against implicated individuals.^[52]

Civil Litigation and User Settlements

Following the 2016 disclosures of the 2013 and 2014 data breaches, numerous putative class action lawsuits were filed by affected Yahoo users in the United States, alleging negligence, breach of implied contract, invasion of privacy, and unjust enrichment due to Yahoo's failure to implement adequate security measures and its delayed notifications, which exposed users to risks of identity theft and fraud.^[53] These actions, stemming from breaches and intrusions between 2012 and 2016 that compromised names, email addresses, phone numbers, birthdates, hashed passwords, and security questions for hundreds of millions of accounts, were consolidated into a multidistrict litigation captioned In re Yahoo! Inc. Customer Data Security Breach Litigation, Case No. 5:16-md-02752-LHK, in the U.S. District Court for the Northern District of California.^[54] In April 2019, Yahoo (operated by Verizon Media at the time) agreed to a $117.5 million settlement to resolve claims by approximately 194 million class members, defined as U.S. and Israeli residents who held Yahoo accounts between January 1, 2012, and December 31, 2016, and whose data was affected by the incidents.^[55]^[53] An earlier $117.5 million proposal from 2018 had been rejected in January 2019 for insufficient class notice, inadequate benefits relative to risks, and unclear opt-out procedures, prompting revisions that enhanced protections and clarity. The court granted preliminary approval to the revised terms and, following extensive discovery—including depositions, document production, and expert analyses—issued final approval on July 22, 2020, after receiving only 31 objections from the class and noting 1,779 opt-outs, which the judge deemed indicative of fairness despite a low per-member recovery of about $0.60 when adjusted for class size and compared to similar cases like In re Anthem ($115 million for 79 million members).^[53] Settlement benefits included a minimum of two years of credit monitoring services for eligible claimants, an alternative cash payment option of up to $358.80 (base $100 plus pro rata shares based on participation), reimbursement for documented out-of-pocket losses up to $25,000 per claimant (covering identity theft protection costs, credit freezes, and related expenses), and compensation for time spent mitigating harms at $25 per hour for up to 15 hours or the claimant's actual wage rate if higher.^[54] Additional relief covered reimbursements for paid Yahoo Mail or Aabaco Small Business services affected by the breaches, while Yahoo committed to bolstering database security protocols as non-monetary consideration.^[56] Claimants had until July 20, 2020, to submit forms, with distributions commencing on June 9, 2023, after administrative reviews and appeals, including a 2022 affirmation of approval.^[54] Parallel civil proceedings occurred internationally, including a Canadian class action that yielded a separate settlement offering eligible claimants up to $405 in cash payments via e-transfer or check, with distributions beginning August 26, 2025.^[57] These user-focused suits contrasted with contemporaneous securities and derivative actions, emphasizing direct harms like potential misuse of compromised credentials rather than investor losses or fiduciary breaches.^[58]

Business and Economic Fallout

Renegotiation of Verizon Acquisition

The announcement of Yahoo's data breaches in September and December 2016, affecting over 3 billion user accounts in total, prompted Verizon to invoke the material adverse event clause in the original acquisition agreement, arguing that the incidents diminished Yahoo's value and exposed Verizon to unforeseen risks.^[6]^[59] Initially agreed upon on July 25, 2016, for $4.83 billion, the deal faced scrutiny as the breaches predated the merger talks but were not disclosed, leading Verizon to demand concessions including a price reduction and shared liabilities.^[60]^[61] Negotiations intensified in early 2017, with Verizon initially seeking a $250 million discount before settling on a $350 million reduction, finalizing the purchase price at $4.48 billion on February 21, 2017.^[6]^[60]^[62] Under the amended terms, Yahoo agreed to indemnify Verizon against certain breach-related liabilities, while the parties would equally share costs from government investigations and third-party litigation arising from the incidents.^[6]^[59] This adjustment reflected Verizon's assessment that the breaches, including state-sponsored hacking attributed to Russian actors, impaired Yahoo's core assets and user trust, though Verizon proceeded with the acquisition to gain Yahoo's engineering talent and properties like Flickr and Tumblr.^[63]^[64] The renegotiated deal closed on June 13, 2017, integrating Yahoo's operations into Verizon's Oath subsidiary (later rebranded as Verizon Media), but the price cut underscored how delayed breach disclosures eroded shareholder value, with Yahoo's market capitalization dropping nearly $1.3 billion immediately following the initial revelation.^[65]^[66] Verizon's executive vice president, Marni Walden, stated that the revised terms accounted for the "known cybersecurity incidents" without altering the strategic rationale, emphasizing due diligence on ongoing risks.^[6]

Financial Costs and Market Consequences

The disclosures of Yahoo's data breaches precipitated a $350 million reduction in the purchase price of its core internet business during the acquisition by Verizon Communications. Originally valued at $4.8 billion when announced on July 25, 2016, the deal was renegotiated to $4.48 billion on February 21, 2017, with the discount explicitly linked to the breaches' impact on Yahoo's value and associated liabilities for investigations and litigation.^[6]^[67] Yahoo's stock experienced volatility and declines tied to the breach revelations. Following the September 22, 2016, disclosure of the 2014 breach affecting 500 million accounts, shares fell approximately 3% amid investor concerns over undisclosed risks during the Verizon negotiations. The December 14, 2016, announcement of the 2013 breach impacting over 1 billion accounts triggered a sharper intraday drop of up to 3.8%, reflecting market assessment of heightened legal and reputational damages.^[68]^[69] Regulatory enforcement imposed direct financial penalties on Yahoo, rebranded as Altaba post-acquisition. On April 24, 2018, the U.S. Securities and Exchange Commission fined the company $35 million for misleading investors by failing to disclose the 2014 breach for nearly two years, marking the first such SEC action against a public company for cybersecurity nondisclosure.^[48]^[49] Civil litigation added substantial settlement costs. A class action lawsuit covering approximately 194 million affected U.S. users from multiple breaches settled for $117.5 million in 2020, including funds for victim compensation and two years of credit monitoring. A related derivative suit alleging board failures in oversight resolved for $29 million in 2019. These payouts, combined with shared liabilities under the Verizon agreement, underscored the breaches' role in eroding Yahoo's financial position without offsetting insurance recoveries publicly detailed at the time.^[53]^[70]

Criticisms, Defenses, and Stakeholder Reactions

Critiques of Yahoo's Negligence and Delay

Critics, including the U.S. Securities and Exchange Commission (SEC), have highlighted Yahoo's failure to promptly disclose the 2014 data breach affecting at least 500 million user accounts, which the company identified in late 2014 but did not reveal publicly until September 2016, over two years later.^[48] This delay misled investors by omitting material information about the breach's severity and potential risks, violating disclosure obligations under securities laws, and resulted in a $35 million SEC penalty against Altaba (formerly Yahoo) in April 2018—the first such enforcement action against a public company for inadequate cyber breach disclosure.^[68] The SEC order noted that Yahoo's senior management assessed the incident as less significant than it was, failing to investigate fully or escalate it appropriately, which compounded the nondisclosure.^[48] Cybersecurity experts and legal analysts have criticized Yahoo's underlying negligence in preventive measures, pointing to outdated security practices that enabled state-sponsored actors to access unencrypted user names, email addresses, and hashed passwords via unauthorized cookies in the 2013 and 2014 breaches.^[71] For instance, despite internal detection of suspicious activity, Yahoo executives did not "properly comprehend or investigate" the intrusions, allowing breaches to persist undetected for months and affecting up to 3 billion accounts cumulatively.^[71] This reflected a broader lapse in corporate governance, including inadequate monitoring of cybersecurity risks and failure to fulfill directors' duties of care in data protection, as outlined in analyses of the incidents.^[12] Further scrutiny arose from Yahoo's contradictory statements; just weeks before the September 2016 announcement, the company claimed awareness of no material breaches, undermining trust and prompting lawsuits alleging negligence and irresponsibility in handling the 2014 hack.^[72]^[73] U.S. District Judge Lucy Koh later rejected a proposed settlement in related class-action litigation, citing Yahoo's "lack of transparency" during the 2013–2014 period as evidence of insufficient accountability for users whose security questions and answers—critical for account recovery—were compromised without timely mitigation.^[74] Experts emphasized that such delays exacerbated user harms, as stolen data fueled ongoing exploitation, including phishing and identity theft, while Yahoo prioritized the Verizon acquisition over immediate remediation.^[75]

Arguments Mitigating Yahoo's Responsibility

The Yahoo data breaches were primarily attributed to sophisticated operations orchestrated by Russian Federal Security Service (FSB) officers, including Dmitry Dokuchaev and Igor Sushchin, in conjunction with cybercriminals Alexsey Belan and Karim Baratov.^[3] These actors gained unauthorized access to Yahoo's network by compromising employee accounts, exploiting the Yahoo User Database and Account Management Tool to steal user credentials and mint forged authentication cookies, enabling access to approximately 6,500 targeted accounts without passwords or security questions.^[3] This technique underscored the advanced persistence and state-level resources deployed, which Yahoo described in legal proceedings as a "triumph of criminal persistence" by a network of skilled cybercriminals rather than a straightforward lapse in basic defenses.^[76] Yahoo positioned itself as a victim of nation-state cyber espionage, cooperating "exemplarily" with the U.S. Department of Justice and FBI to identify and prosecute the perpetrators, including providing data that facilitated indictments against the FSB officers and their accomplices.^[3] The involvement of intelligence agencies protecting hackers and targeting high-value accounts, such as those of journalists and officials, highlighted systemic challenges in defending against determined adversaries with insider knowledge and evasion tactics.^[3] Such operations, akin to those affecting other entities like Google, illustrate that even robust corporations face inherent vulnerabilities against resourced state actors prioritizing infiltration over detection.^[3] Defenses emphasized that the breaches did not involve direct financial data theft but rather personal identifiers exploited for secondary gains like spam and credential resale, outcomes more attributable to the hackers' motives than Yahoo's configuration.^[3] While critics pointed to outdated practices like MD5 hashing, proponents of mitigation argued that the cookie-forging bypass rendered traditional password protections insufficient against tailored, intelligence-backed intrusions.^[76] This perspective frames Yahoo's exposure as emblematic of broader geopolitical cyber threats, where corporate responsibility intersects with unattributable state aggression.

Government and International Responses

In March 2017, the U.S. Department of Justice indicted two officers of Russia's Federal Security Service (FSB), Dmitry Dokuchaev and Igor Sushchin, along with hackers Alexsey Belan and Karim Baratov, for their roles in the 2014 Yahoo data breach and related intrusions affecting millions of accounts.^[3] The charges included conspiracy to commit computer fraud, theft of government information, and unauthorized access to computers, attributing the hacks to state-sponsored cyber operations aimed at intelligence gathering.^[3] Baratov, a Canadian resident of Russian descent, was arrested in Canada on March 14, 2017, extradited to the United States, pleaded guilty in November 2017, and was sentenced to five years in prison in 2018 for providing hacking services to the FSB.^[3] Belan, a Russian national previously indicted in 2014 for unrelated hacks, remained at large in Russia, while the FSB officers were charged in absentia, underscoring challenges in prosecuting foreign state actors.^[3] The U.S. Securities and Exchange Commission (SEC) pursued civil regulatory action separately, charging Altaba Inc. (Yahoo's successor entity post-Verizon sale) in April 2018 with misleading investors by failing to disclose the 2014 breach's full scope and impact from 2014 to 2016.^[48] Altaba agreed to a $35 million civil penalty to settle the claims, marking the SEC's first enforcement action specifically for inadequate cybersecurity disclosure under federal securities laws, without admitting or denying wrongdoing.^[48] This reflected broader U.S. government emphasis on corporate accountability for breach transparency, amid investigations by the Federal Bureau of Investigation (FBI) that had prompted Yahoo's cooperation since 2014.^[48] Internationally, the Irish Data Protection Commission (DPC), acting as Yahoo's lead EU regulator, investigated the breaches under pre-GDPR data protection directives and concluded in June 2018 that Yahoo's oversight of its Canadian data processor fell short of required standards, exposing user data to unauthorized access.^[77] The DPC found no evidence of deliberate misconduct by Yahoo but criticized inadequate vendor controls and audit practices, leading to recommendations for enhanced compliance rather than fines, as the events predated the EU's General Data Protection Regulation.^[77] Canadian authorities facilitated Baratov's arrest and extradition under a bilateral treaty with the U.S., demonstrating cross-border law enforcement coordination against cybercrime, though no independent Canadian regulatory penalties were imposed on Yahoo.^[3] Other nations, including affected EU members, expressed concerns over the breaches' implications for global data security but deferred to U.S.-led prosecutions without initiating parallel actions.^[77]

Enduring Impacts

User Harms and Data Exploitation Outcomes

The Yahoo data breaches of 2013 and 2014 exposed personal information from over 3 billion user accounts, including names, email addresses, telephone numbers, birth dates, hashed passwords, and security questions, heightening risks of unauthorized access and exploitation.^[4] This data facilitated widespread phishing campaigns, where attackers used stolen credentials to impersonate users or craft targeted lures, leading to account takeovers on Yahoo and linked services.^[78] Users reported surges in spam and fraudulent emails post-disclosure in 2016, as the datasets enabled credential-stuffing attacks—automated attempts to reuse leaked passwords across platforms.^[79] Exploited data appeared on dark web marketplaces shortly after the breaches, sold in bulk for as low as a few dollars per record to enable identity theft, financial fraud, and social engineering schemes.^[80] Criminals leveraged the information for activities such as opening fraudulent accounts, medical identity fraud, and unauthorized credit applications, resulting in documented user losses including unreimbursed fees for identity theft remediation and credit monitoring services.^[81] In the subsequent class-action settlements, affected users claimed compensation for out-of-pocket expenses tied to these incidents, with Yahoo allocating funds for documented fraud-related charges and three years of credit monitoring.^[82] Enduring outcomes include persistent vulnerabilities, as the breached data continues to circulate among cybercriminals, contributing to long-term financial and emotional distress for victims through repeated exploitation attempts years after disclosure.^[83] While exact aggregate financial losses remain unquantified due to underreporting, the scale amplified broader ecosystem risks, such as cross-platform compromises where Yahoo credentials unlocked access to banking or email services, underscoring the causal chain from poor encryption and delayed detection to sustained user harm.^[4]^[78]

Lessons for Corporate Cybersecurity Practices

The Yahoo data breaches of 2013 and 2014 exposed systemic vulnerabilities in large-scale data handling, particularly the failure to encrypt sensitive information adequately, with security questions stored in plaintext and passwords hashed using the outdated and crackable MD5 algorithm.^[4] ^[84] This enabled attackers, including state-sponsored groups, to exfiltrate usable personal identifiers like names, emails, phone numbers, and birth dates from over 3 billion accounts without detection for years.^[4] Corporations must therefore adopt modern encryption standards, such as bcrypt for passwords and end-to-end encryption for stored data, to render compromised information valueless to adversaries.^[85] ^[84] Inadequate monitoring allowed the 2013 intrusion to persist undetected until 2016, highlighting the need for real-time anomaly detection systems and continuous logging to identify unauthorized access swiftly.^[4] ^[84] Regular vulnerability scanning, patching of known exploits, and penetration testing are imperative to address technical flaws proactively, as Yahoo's unpatched systems facilitated cookie forgery and data theft.^[4] Implementing multi-factor authentication across all user and administrative accounts further reduces risks from credential compromise, a common entry vector in such attacks.^[85] Yahoo's delayed internal response and public disclosure—despite awareness by 2014—incurred a $35 million SEC penalty for investor misrepresentation and eroded trust, demonstrating that organizations require predefined incident response plans with mandated timelines for breach notification to regulators, users, and shareholders.^[48] ^[86] Breaches are often inevitable given persistent threats, but effective preparation, including simulations and cross-functional teams, minimizes fallout through rapid containment and transparency.^[86] At the organizational level, underinvestment in cybersecurity culture contributed to executive inaction on known risks, with only 14% of public company directors reporting strong risk comprehension per surveys.^[86] Boards should enforce dedicated oversight, resource allocation for security tools, and employee training to instill vigilance, treating all data types as potentially exploitable for phishing or identity theft.^[85] ^[84] In acquisitions, rigorous due diligence on target cybersecurity postures is essential, as Yahoo's lapses prompted a $350 million Verizon price cut.^[86]

Evolution in Industry Standards Post-Yahoo

The disclosure of the Yahoo data breaches in 2016, involving over three billion accounts, exposed systemic delays in breach reporting and inadequate investor disclosures, catalyzing regulatory evolution in cybersecurity transparency. The U.S. Securities and Exchange Commission (SEC) charged Yahoo (rebranded as Altaba) in April 2018 with misleading investors by failing to disclose the 2014 breach affecting 500 million accounts, resulting in a $35 million penalty—the first such enforcement action against a public company for cybersecurity disclosure failures under federal securities laws.^[48] This precedent underscored the materiality of cyber incidents, prompting companies to integrate breach risks into periodic filings more rigorously.^[68] Building on this, the SEC finalized rules in July 2023 mandating public companies to disclose material cybersecurity incidents via Form 8-K within four business days of determination, alongside annual reporting of cybersecurity risk management and governance in Form 10-K filings.^[87] These requirements aim to curb delayed revelations like Yahoo's, where the company knew of intrusions since at least 2014 but did not publicize them until 2016, amid its Verizon acquisition negotiations. The rules reflect a causal link between high-profile nondisclosures and demands for standardized, expedited reporting to mitigate investor harm and enable faster mitigation.^[88] Internationally, the breaches amplified scrutiny under evolving data protection regimes. Ireland's Data Protection Commission concluded in June 2018 that Yahoo's oversight of third-party data processors fell short of EU standards, influencing the enforcement emphasis in the General Data Protection Regulation (GDPR), effective May 2018, which requires controllers to notify supervisory authorities of breaches within 72 hours and demonstrate accountability in processor contracts.^[77] While GDPR's framework predated full Yahoo disclosures, the incidents exemplified risks of lax vendor management and delayed notifications, contributing to global harmonization efforts for stricter timelines and fines up to 4% of annual turnover.^[89] In corporate practices, post-Yahoo analysis has driven partial shifts toward elevated governance, with cybersecurity now a board-level priority in many firms, including routine audits and alignment with frameworks like NIST Cybersecurity Framework version 1.1 (2018 update).^[88] However, industry experts observe limited systemic evolution, as vulnerabilities like weak password hashing (e.g., Yahoo's use of MD5) and phishing susceptibility persist, with state-sponsored actors exploiting similar flaws in subsequent breaches.^[88] Calls for a comprehensive U.S. federal breach notification law intensified post-2016 but remain unfulfilled, leaving patchwork state requirements in place.^[90] Overall, while disclosure standards have advanced, foundational practices lag, underscoring ongoing gaps in proactive defenses despite regulatory pressures.^[88]

References

[1]
Yahoo Still Ranks As The Largest Data Breach In History
Jul 3, 2025 · In what is considered the largest data breach in history, all 3 billion Yahoo user accounts were compromised by a 2013 breach that went undetected for three ...
[2]
Biggest Data Breaches in US History (Updated 2025) | UpGuard
Jun 30, 2025 · However, after Verizon bought out Yahoo in 2017, they reported that the final number of records totaled about 3 billion accounts affected. Not ...
[3]
U.S. Charges Russian FSB Officers and Their Criminal Conspirators ...
Mar 15, 2017 · ... Hacking Yahoo and ... information regarding FSB investigations of computer hacking and FSB techniques for identifying criminal hackers.Missing: details | Show results with:details
[4]
Yahoo Data Breach: What Happened and How to Prevent It
Mar 18, 2025 · In August 2013, a group of unknown hackers exploited a vulnerability in Yahoo's system and exposed the personal data of every single user. How ...
[5]
All 3 Billion Yahoo Accounts Were Affected by 2013 Attack
Oct 3, 2017 · All 3 Billion Yahoo Accounts Were Affected by 2013 Attack ... It was the biggest known breach of a company's computer network. And now, it is even ...
[6]
Verizon, Yahoo agree to lowered $4.48 billion deal following cyber ...
Feb 21, 2017 · The data breach may delay some integration of Yahoo with Verizon after the closing, the person said. The deal brings to Verizon Yahoo's more ...
[7]
Yahoo Takes $350 Million Hit in Verizon Deal - BankInfoSecurity
Feb 22, 2017 · Verizon will pay $350 million less for Yahoo than it first offered because the deal subsequently became tainted by three data breach ...
[8]
Yahoo says all three billion accounts hacked in 2013 data theft
Oct 4, 2017 · The company said the investigation indicated that the stolen information did not include passwords in clear text, payment card data, or bank ...
[9]
Yahoo suffers world's biggest hack affecting 1 billion users
Dec 14, 2016 · Yahoo has discovered a 3-year-old security breach that enabled a hacker to break into more than 1 billion user accounts.
[10]
Yahoo says hackers stole data from 500 million accounts in 2014
Sep 23, 2016 · Yahoo Inc <YHOO.O> said on Thursday that at least 500 million of its accounts were hacked in 2014 by what it believed was a state-sponsored ...
[11]
Yahoo faces questions after hack of half a billion accounts
Sep 23, 2016 · Details, including names, email addresses, phone numbers and security questions were taken from the company's network in late 2014.<|separator|>
[12]
[PDF] THE YAHOO DATA BREACH - American University Law Review
Oct 5, 2017 · Yahoo had a data breach affecting over 500 million accounts in 2014, and another 1 billion in 2013, raising corporate governance issues.
[13]
the identities of hackers behind the 2014 Yahoo data breach revealed
Mar 17, 2017 · Major discovery: the identities of hackers behind the 2014 Yahoo data breach revealed · ^ Seth Fiegerman . Yahoo says 500 million accounts stolen ...
[14]
Lessons from the Yahoo Hack - Risk Management Magazine
Oct 2, 2017 · The attackers penetrated Yahoo's systems from 2014 to 2016, likely through spear-phishing attacks in at least some instances.
[15]
The Yahoo Data Breach - American University Law Review
The information stolen likely included names, birthdays, telephone numbers, email addresses, hashed passwords, and, in some cases, encrypted or unencrypted ...
[16]
Yahoo Says 1 Billion User Accounts Were Hacked
Dec 14, 2016 · The company says the attack was separate from the breach that led to an earlier disclosure that 500 million accounts were hacked.Missing: exploited weaknesses
[17]
Yahoo Data Breaches: A Lesson in What Not to Do - Byte Back
Mar 2, 2017 · It appears that in 2013, when the first data breach occurred, Yahoo was still using a discredited technology for data encryption known as MD5.Missing: exploited | Show results with:exploited
[18]
Inside the Russian hack of Yahoo: How they did it - CSO Online
Oct 4, 2017 · Here's how the FBI says they did it: The hack began with a spear-phishing email sent in early 2014 to a Yahoo company employee. It's unclear ...
[19]
How did Yahoo get breached? Employee got spear phished, FBI ...
Mar 15, 2017 · Over the course of the breach, the FBI said, the FSB agents and Belan used the cookies to access “more than 6,500 Yahoo accounts.” Target-rich ...
[20]
A Single Spear Phishing Click Caused The Yahoo Data Breach
Mar 18, 2017 · Here's how the FBI says they did it: The hack began with a spear-phishing email sent in early 2014 to a Yahoo company employee.
[21]
Yahoo security problems a story of too little, too late | Reuters
Dec 18, 2016 · Last September, Yahoo disclosed a 2014 cyber attack that affected at least 500 million customer accounts, the biggest known data breach at the ...
[22]
Yahoo! Mail introduces two factor authentication - ZDNET
Dec 19, 2011 · Any suspicious account sign-in attempt will be challenged by a second sign-in verification beyond the initial password validation.
[23]
Yahoo deploys two-factor authentication for email | SC Media
Dec 20, 2011 · Application security, Network Security, Security Strategy, Plan, Budget. Yahoo deploys two-factor authentication for email. December 20, 2011.
[24]
Yahoo failed to prioritize security: report - The Hill
Sep 28, 2016 · The Times reported that CEO Marissa Mayer, the former Google executive brought on to turn Yahoo around, opted not to pursue certain security ...
[25]
Marissa Mayer declined to reset Yahoo users' passwords 2 years ago
Sep 28, 2016 · Marissa Mayer declined to reset Yahoo users' passwords 2 years ago. Insiders say that strong security measures were repeatedly rejected in favor ...Missing: prioritization | Show results with:prioritization
[26]
Security! experts! slam! Yahoo! management! for! using! old! crypto!
Dec 15, 2016 · "This breach clearly shows that Yahoo!'s previous approach to security was less than ideal, and it's obvious that the Paranoids (Yahoo!'s ...
[27]
Security experts: 'No one should have faith in Yahoo at this point'
Dec 15, 2016 · Yahoo 'did not take security seriously enough', failing to prevent a hack which exposed the data of 1 billion users.Missing: internal pre-<|separator|>
[28]
Yahoo investigating exposure of 400,000 passwords - BBC News
Jul 12, 2012 · Web giant Yahoo has confirmed it is investigating a breach of its system which may have exposed 450,000 user IDs.
[29]
Hackers expose 453,000 credentials allegedly taken from Yahoo ...
Hackers posted what appear to be login credentials for more than 453,000 user accounts that they said they retrieved in plaintext from an ...
[30]
Yahoo Voice hack leaks 450000 passwords - The Guardian
Jul 12, 2012 · More than 450,000 usernames and unencrypted passwords appear to have been stolen from Yahoo Voice, a user-contribution services on Yahoo's ...
[31]
Hackers Spill More Than 450,000 Email Addresses And Passwords ...
Jul 12, 2012 · The security firm TrustedSec claims that it's linked the stolen data with the Yahoo! Voice service. According to a count by DataLossDB, the ...<|control11|><|separator|>
[32]
Report: Half a Million Yahoo User Accounts Exposed in Breach
Jul 12, 2012 · Hackers have published half a million login credentials for what appear to be Yahoo Voices user accounts that were stolen from a server.
[33]
A History of Yahoo Hacks | MIT Technology Review
Dec 15, 2016 · A History of Yahoo Hacks · 2013: Phishing for Mail · 2014: Yahoo Mail (Again) · 2016: The Half-Billion Hack · 2016: The Full Billion.
[34]
Yahoo Data Breach: Can It Affect Your Business? | Indusface Blog
May 18, 2021 · For example, in 2012, Yahoo Voices was the target of a similar data breach that exposed email addresses and passwords of 453,491 users.
[35]
What happened in the Yahoo data breach? - Twingate
May 23, 2024 · In July 2012, Yahoo's online publishing service "Voices" experienced a significant data breach. The incident highlighted the issue of password reuse.
[36]
The Hacked & the Hacker-for-Hire: Lessons from the Yahoo Data ...
May 11, 2018 · Then, on October 3, 2017, Yahoo disclosed that all of its users (3 billion accounts) had likely been affected by the hacking activity that ...
[37]
Yahoo knew of 'state-backed' hack in 2014 - BBC News
Nov 10, 2016 · Yahoo has confirmed that it knew for two years that a "state-sponsored actor" had hacked into its network.
[38]
Yahoo execs botched its response to 2014 breach, investigation finds
Mar 1, 2017 · The committee found that Yahoo's security team and senior executives actually knew that a state-sponsored actor had hacked certain user accounts ...
[39]
Yahoo admits some employees knew about 2014 data breach at the ...
Mar 3, 2017 · Some Yahoo employees were aware of a security breach which compromised approximately 500 million customer email accounts at the time of the ...
[40]
Yahoo breach: how on earth did it take them three years to notice?
Dec 15, 2016 · To the casual observer, three years is a long time, and it makes them suspicious that the company was deliberately keeping users in the dark.
[41]
Could Zero Trust Have Stopped the 2013 Yahoo Breach?
The absence of continuous monitoring left Yahoo blind to the breach, delaying any potential response and mitigation efforts. Yahoo's infrastructure also lacked ...
[42]
Yahoo offers new details on breaches to Senate committee
Feb 27, 2017 · The independent committee formed by Yahoo's board of directors is investigating the timeline, according to the SEC filing. A spokesperson for ...
[43]
Yahoo data breach is among the biggest in history - CNBC
Sep 22, 2016 · The data, which was stolen in late 2014 by what the company called a "state-sponsored actor," may include names, emails, telephone numbers, ...
[44]
Yahoo hack: 1bn accounts compromised by biggest data breach in ...
Dec 14, 2016 · Yahoo said on Wednesday it had discovered another major cyber attack, saying data from more than 1bn user accounts was compromised in August 2013.
[45]
Every Yahoo Account That Existed In Mid-2013 Was Likely Hacked
Oct 3, 2017 · Last September, Yahoo reported an incident affecting 500 million accounts that took place in 2014. Then, in December, came the disclosure of the ...Missing: timeline | Show results with:timeline
[46]
Canadian Hacker Who Conspired With and Aided Russian FSB ...
Nov 28, 2017 · Count One charged Baratov, Dokuchaev, Sushchin and Belan with conspiring to violate the Computer Fraud and Abuse Act by stealing information ...
[47]
International Hacker-For-Hire Who Conspired With And Aided ...
May 30, 2018 · SAN FRANCISCO – Karim Baratov, aka Kay, aka Karim Taloverov, aka Karim Akehmet Tokbergenov, 23, was sentenced to 60 months in prison and ...Missing: breach | Show results with:breach
[48]
Altaba, Formerly Known as Yahoo!, Charged With Failing ... - SEC.gov
Apr 24, 2018 · Altaba, Formerly Known as Yahoo!, Charged With Failing to Disclose Massive Cybersecurity Breach; Agrees To Pay $35 Million. For Immediate ...
[49]
[PDF] Altaba Inc. and f/d/b/a Yahoo! Inc. - SEC.gov
Apr 24, 2018 · After Yahoo disclosed the 2014 data breach, Verizon renegotiated the stock purchase agreement to reduce the price paid for Yahoo's operating ...
[50]
SEC Fines Yahoo $35 Million Over 2014 Breach - BankInfoSecurity
Apr 25, 2018 · Yahoo, now known as Altaba, has agreed to a $35 million civil fine with the U.S. Securities and Exchange Commission to settle accusations ...Missing: penalties | Show results with:penalties
[51]
Yahoo's EU regulator orders privacy changes over data breach
Jun 7, 2018 · Yahoo's European regulator has ordered it to make privacy changes following a probe into what it said was one of the largest ever data ...
[52]
Canadian who helped Yahoo email hackers gets five years in prison
May 29, 2018 · ... of a massive 2014 data breach at Yahoo was sentenced to five years in prison on Tuesday and ordered to pay a $250000 fine.
[53]
Court Approves Class Action Settlement in IN RE - Privacy World
Aug 3, 2020 · Court Approves Class Action Settlement in IN RE: YAHOO! INC. CUSTOMER DATA SECURITY BREACH LITIGATION and Also Provides Helpful Guidelines to ...Missing: lawsuits | Show results with:lawsuits
[54]
Yahoo! Inc. Customer Data Security Breach Litigation Settlement
Defendants will also pay for a Settlement Fund of $117,500,000. The Settlement Fund will provide a minimum of two years of Credit Monitoring Services to protect ...Payment Selection · File Claim · Contact Form · FAQs
[55]
Yahoo strikes $117.5 million data breach settlement after earlier ...
Apr 9, 2019 · Separately, Verizon agreed to spend $306 million between 2019 and 2022 on information security, five times what Yahoo spent from 2013 to 2016.<|separator|>
[56]
Administration of the Yahoo Data Breach Class Action Settlement
Learn how Kroll's Settlement Administration Team successfully administered one of the largest international data breach class action settlements. Read more.Missing: civil | Show results with:civil
[57]
Yahoo Data Breach Class Action
This website has been established to provide general information related to the proposed settlement of the case referred to as Yahoo Data Breach Class Action.FAQ · Documents · Contact Us · Français
[58]
Yahoo! Settles Data Breach Securities Class Action for $80 Million
On December 14, 2016, post-market, Yahoo announced that it had uncovered a data breach, stating that data from more than 1 billion user accounts was compromised ...Missing: exact | Show results with:exact
[59]
[PDF] The Erratic Closing of the Verizon-Yahoo Merger - Boston University
Jul 25, 2016 · December 2016, Yahoo announced it had been the victim of a second ... . 991 See Reuters, Why Verizon Now Thinks Yahoo's Data Breach Could Halt the.
[60]
Verizon Reaches Deal for Lowered Yahoo Price After Hacks
Feb 21, 2017 · Verizon Communications Inc. will acquire Yahoo! Inc.'s Internet properties at a $350 million discount after revelations of security breaches at the web company.
[61]
How Yahoo's Data Breach Could Affect Its Deal With Verizon
Sep 23, 2016 · Verizon could enact the deal's material adverse change clause, or MAC clause, to try to drive down the price or terminate the sale entirely.<|control11|><|separator|>
[62]
Verizon and Yahoo agree $350m price cut - BBC News
Feb 21, 2017 · US telecoms giant Verizon has reached a deal with Yahoo to buy the company's core internet business for $350m (£281m) less than originally agreed.<|separator|>
[63]
Yahoo Breach May Trigger 'Material Adverse Change' Clause
The Yahoo data breach, which compromised 500 million user accounts, may cause Verizon to renegotiate its $4.8 billion acquisition deal.
[64]
How Verizon delicately handled the Yahoo breach - CyberScoop
Dec 14, 2017 · And as the breach became public knowledge, Verizon was inundated with recommendations and presumptions that it would lower its price offering ...
[65]
$$35 Million Yahoo Fine Reflects SEC's Heightened Cybersecurity ...
May 4, 2018 · When Yahoo ultimately disclosed the breach in September 2016, its market capitalization fell by almost $1.3 billion, and Verizon renegotiated ...
[66]
Breach Repercussions: Yahoo Reports Verizon Deal Delay
Yahoo's executives expect the company's sale to Verizon to be delayed as the search giant continues to investigate two massive data breaches.<|separator|>
[67]
Verizon Will Pay $350 Million Less for Yahoo - The New York Times
Feb 21, 2017 · Verizon will pay $4.48 billion for Yahoo, about $350 million less than it initially offered after security breaches that were disclosed last year.
[68]
Failure to Disclose a Cybersecurity Breach
May 17, 2018 · On April 24, 2018, Altaba, formerly known as Yahoo, entered into a settlement with the Securities and Exchange Commission (the “SEC”), ...Missing: pre- | Show results with:pre-
[69]
Yahoo shares fall after latest security breach
Dec 15, 2016 · (Reuters) - Yahoo Inc's shares fell as much as 3.8 percent on Thursday, a day after the company said that more than 1 billion user accounts ...
[70]
Yahoo Data Breach-Related Derivative Suit Settled for $29 Million
Jan 21, 2019 · On December 14, 2016 Yahoo disclosed that it had been subject to an even larger data breach, involving one billion users, in 2013 which involved ...
[71]
Yahoo and 'the failure to comprehend' - CSO Online
Mar 9, 2017 · Yahoo Inc. recently told the SEC that its senior executives failed to “properly comprehend or investigate” the 2013 and 2014 security breaches ...
[72]
How a data breach battered Yahoo!'s reputation - Raconteur
Nov 27, 2016 · Yahoo! has also been criticised for saying just a week or two before the disclosure that it wasn't aware of any security breaches. In fact, the ...
[73]
Yahoo! Dragged to Court for Delaying Data Breach News
Sep 26, 2016 · Yahoo! Inc.'s YHOO streak of bad luck continues as the company has been sued for irresponsibility and negligence over a massive 2014 hacking ...Missing: critiques | Show results with:critiques
[74]
What Yahoo's rejected settlement means for industry expectations of ...
Jan 30, 2019 · U.S. district judge Lucy Koh criticized Yahoo's lack of transparency during the time of three data breaches, which took place between 2013 and ...Missing: critiques | Show results with:critiques
[75]
Yahoo data breach: these security experts have some questions for ...
Sep 23, 2016 · Yahoo users should be particularly concerned that the stolen information includes security questions and answers as this could leave them open ...
[76]
Yahoo Must Face Litigation by Data Breach Victims, Judge Rules
Aug 31, 2017 · In court papers, Yahoo had argued that the breaches were "a triumph of criminal persistence" by a "veritable 'who's who' of cybercriminals," and ...Missing: mitigating responsibility<|separator|>
[77]
Data Protection Commission concludes investigation into Yahoo ...
Jun 7, 2018 · Yahoo's oversight of the data processing operations performed by its data processor did not meet the standard required by EU data protection law ...<|separator|>
[78]
Cybercriminals Breach Yahoo, Impacting 500 Million Users - McAfee
Usernames, protected passwords, dates of birth, associated email addresses and more were allegedly stolen in late 2014, meaning the cybercriminals behind the ...<|separator|>
[79]
The 500 Million Hacked Yahoo Accounts Are A Phishing Paradise ...
Sep 23, 2016 · Yahoo launched an investigation into a possible breach in early August after a Russian hacker named “Peace” offered to sell a data dump of over ...
[80]
Following Your Stolen Data Through The Dark Web
Oct 16, 2025 · Stolen data is often sold to other cyber criminals who use it for identity theft, taking over social media accounts, medical fraud, and more.
[81]
Yahoo! Inc. Customer Data Security Breach Litigation Settlement
This case involves multiple data breaches occurring at Yahoo in 2013 through 2016, as well as data security intrusions occurring in early 2012.
[82]
Yahoo Data Breach – Settlement Details - Talli Insights
The Yahoo settlement established a $117.5 million fund to compensate affected users from data breaches occurring between 2012-2016. Distribution payments began ...Yahoo Data Breach Settlement... · Fraud Prevention Measures... · Frequently Asked Questions<|control11|><|separator|>
[83]
Biggest Data Breach Ever Spotlights Ongoing Challenges for Users ...
Aug 14, 2025 · Exposed data can be reused, repackaged, and exploited for years, causing long-term reputational damage, financial loss, and emotional stress.
[84]
Case Study: Lessons Learned from the Yahoo Data Breach
Aug 10, 2024 · The breaches exposed significant security flaws within Yahoo's infrastructure and led to severe repercussions, including a loss of user trust, ...
[85]
The Great Yahoo Data Breach: 6 Steps to Reducing Risk | TDWI
Oct 10, 2016 · There are many lessons from the Great Yahoo Data Breach, including six steps your enterprise should take to minimize risks or respond when a breach is ...Missing: internal | Show results with:internal
[86]
Three Lessons All Companies Can Learn from the Data Breaches ...
Mar 15, 2017 · Three Lessons All Companies Can Learn from the Data Breaches that Cost Yahoo $350 Million · Companies Remain Unprepared to Face Cybersecurity ...
[87]
https://www.darkreading.com/cybersecurity-analytics/sec-adopts-new-rule-on-cybersecurity-incident-disclosure-requirements
[88]
10 Years After Yahoo Breach, What's Changed? (Not Much)
Jan 2, 2024 · Yahoo customers suffered the largest data breaches in history by some measures. But a decade on, experts warn, we still haven't learned our lesson.
[89]
Protecting Our Digital Future: Lessons from the Yahoo Cyber Attack ...
Nov 17, 2023 · The company's delayed detection of the breach also indicated a need for more proactive security measures and monitoring systems. Aftermath and ...Background Of Yahoo In 2013 · Impact On Yahoo And Its... · For Yahoo
[90]
Calls for Federal Breach Notification Law Continue After Yahoo Data ...
Oct 4, 2016 · The call for federal breach notification legislation was revived by the FTC on September 27, 2016, five days after the Yahoo breach was ...