Yahoo suffered a breach in August 2013 that ultimately affected all three billion user accounts, but disclosed it only on December 14, 2016, after initially reporting that one billion accounts were compromised. A separate intrusion disclosed on September 22, 2016 affected more than 500 million accounts and included names, email addresses, telephone numbers, birth dates, hashed passwords, and security questions. Yahoo had known of the 2014 intrusion since at least that year, yet its September 9, 2016 SEC filing said it was unaware of any security breach or unauthorized acquisition of user data. Investigators later identified a cookie-based attack that allowed authentication as users without passwords; Yahoo reported that 32 million accounts were accessed through that technique during 2015 and 2016.
The FBI charged four people in March 2017, including Russian FSB officers Dmitry Dokuchaev and Igor Sushchin, hacker Alexsey Belan, and Canadian hacker Karim Baratov. Baratov pleaded guilty to hacking at least 80 non-Yahoo accounts for Russian contacts and was sentenced in May 2018 to five years in prison and ordered to pay $2.25 million. Yahoo’s internal review found that Marissa Mayer and other executives knew of the intrusions; General Counsel Ronald S. Bell resigned, and Mayer forfeited $12 million in compensation. Verizon cut its Yahoo acquisition price by $350 million to $4.48 billion in February 2017. The SEC fined Altaba $35 million in 2018 for delayed disclosure, while a 2019 class-action settlement reached $117.5 million and included credit monitoring.
