Yahoo data breaches

{{short description|Major data breaches which occurred at Yahoo!}}

In 2013 and 2014, the American web services company Yahoo was subjected to two of the largest data breaches on record. Although Yahoo was aware, neither breach was revealed publicly until September 2016.

The 2013 data breach occurred on Yahoo servers in August 2013 and affected all three billion user accounts. The 2014 breach affected over 500 million user accounts. Both breaches are considered the largest ever discovered and included names, email addresses, phone numbers, birth dates, and security questions—both encrypted and unencrypted. When Yahoo made the breaches public in 2016, they acknowledged being aware of the second intrusion since 2014.

These incidents led to the indictment of four individuals linked to the latter breach, including the Canadian hacker Karim Baratov who received a five-year prison sentence and also prompted widespread criticism of Yahoo for their delayed response. The fallout included a U.S. $117.5 million class-action lawsuit settlement, a $35 million fine from the U.S. Securities and Exchange Commission, scrutiny by the United States Congress, and complications for Verizon Communication's 2017 acquisition of Yahoo.

August 2013: breach

File:Marissa_Mayer,_World_Economic_Forum_2013_II.jpg, who was CEO of Yahoo at the time of the breaches, at the World Economic Forum 2013 ]]

The first data breach occurred on Yahoo servers in August 2013{{cite web | url=https://www.nytimes.com/2016/12/14/technology/yahoo-hack.html | title=Yahoo Says 1 Billion User Accounts Were Hacked | first=Vindu | last=Goel | date=December 14, 2016 | access-date=December 14, 2016 | work=The New York Times | archive-date=December 14, 2016 | archive-url=https://web.archive.org/web/20161214224401/http://www.nytimes.com/2016/12/14/technology/yahoo-hack.html | url-status=live }} and affected all three billion user accounts.{{cite web |last1=McMillan |first1=Robert |last2=Knutson |first2=Ryan |date=October 3, 2017 |title=Yahoo Triples Estimate of Breached Accounts to 3 |url=https://www.wsj.com/articles/yahoo-triples-estimate-of-breached-accounts-to-3-billion-1507062804 |url-status=live |archive-url=https://web.archive.org/web/20210126120636/https://www.wsj.com/articles/yahoo-triples-estimate-of-breached-accounts-to-3-billion-1507062804 |archive-date=January 26, 2021 |access-date=October 3, 2017 |work=The Wall Street Journal}}{{cite web | url=https://www.cnbc.com/2017/10/03/yahoo-every-single-account-3-billion-people-affected-in-2013-attack.html | title=Yahoo just said every single account was affected by 2013 attack — 3 billion in all | first=Todd | last=Haselton | date=October 3, 2017 | access-date=October 3, 2017 | work=CNBC | archive-date=October 3, 2017 | archive-url=https://web.archive.org/web/20171003204206/https://www.cnbc.com/2017/10/03/yahoo-every-single-account-3-billion-people-affected-in-2013-attack.html | url-status=live }} Yahoo announced the breach on December 14, 2016.{{cite journal |last1=Trautman |first1=Lawrence J. |last2=Ormerod |first2=Peter |date=February 9, 2017 |title=Corporate Directors’ and Officers’ Cybersecurity Standard of Care: The Yahoo Data Breach |url=https://ssrn.com/abstract=2883607 |journal=American University Law Review |volume=66 |pages=1231 |doi=10.2139/ssrn.2883607 |access-date=2024-05-01|url-access=subscription }} Marissa Mayer, who was CEO of Yahoo at the time of the breach, testified before Congress in 2017 that Yahoo had been unable to determine who perpetrated the 2013 breach.{{Cite web |last=Shabad |first=Rebecca |date=2017-11-08 |title=Yahoo hack, Equifax data breach hearing: Richard Smith and Marissa Mayer will testify to Senate Commerce Committee |url=https://www.cbsnews.com/live-news/senate-panel-holds-hearing-on-equifax-breach-consumer-data-security-live-updates/ |access-date=2024-03-26 |website=www.cbsnews.com |language=en-US}}

Early 2014: security culture at Yahoo

A year after Yahoo was identified by the American whistleblower Edward Snowden as a frequent target for state-sponsored hackers in 2013, the company hired a dedicated chief information security officer, Alex Stamos. While Stamos' hiring was praised by technology experts as showing Yahoo's commitment towards better security, Yahoo CEO Marissa Mayer had reportedly denied Stamos and his security team sufficient funds to implement the security measures they recommended, and he departed the company by 2015.

Late 2014: breach

During November or December 2014 a hacker, believed by the U.S. Justice Department to be the Russian national Alexey Belan, copied a November 2014 backup of Yahoo's User Account Database, containing details of over 500 million accounts to a computer under his control.{{cite web |author=U.S. Department of Justice |date= |title=Indictment |url=https://www.justice.gov/opa/press-release/file/948201/dl?inline |publisher=Department of Justice |access-date=2024-03-26}} The User Account Database included data from over 500 million user accounts, including account names, email addresses, telephone numbers, dates of birth, hashed passwords, and in some cases, encrypted or unencrypted security questions and answers through manipulated web cookies.{{cite web | url=http://www.nbcnews.com/tech/tech-news/your-yahoo-account-was-probably-hacked-company-set-confirm-massive-n652586 | title=Yahoo Says 'State-Sponsored Actor' Hacked 500M Accounts | first=Alyssa | last=Newcomb | publisher=NBC News | date=September 22, 2016 | access-date=September 22, 2016 | archive-date=September 22, 2016 | archive-url=https://web.archive.org/web/20160922212631/http://www.nbcnews.com/tech/tech-news/your-yahoo-account-was-probably-hacked-company-set-confirm-massive-n652586 | url-status=live }}{{cite web |title=Account Security Issue FAQs |url=https://help.yahoo.com/kb/account/SLN27925.html |publisher=Yahoo! |access-date=September 23, 2016 |archive-date=September 22, 2016 |archive-url=https://web.archive.org/web/20160922191232/https://help.yahoo.com/kb/account/SLN27925.html |url-status=live }}Shankar, Nithya, and Zareef Mohammed. “Surviving Data Breaches: A Multiple Case Study Analysis.” Journal of Comparative International Management 23.1 (2020): 35–54. Web. The majority of Yahoo's passwords used the bcrypt hashing algorithm, which is considered difficult to crack, with the rest potentially using older algorithms such as the MD5 algorithm, which could be broken rather quickly.{{cite web | url=https://arstechnica.com/security/2016/09/yahoo-says-half-a-billion-accounts-breached-by-nation-sponsored-hackers/ | title=Yahoo says half a billion accounts breached by nation-sponsored hackers | first=Dan | last=Goodin | date=September 22, 2016 | access-date=December 15, 2016 | work=Ars Technica | archive-date=December 15, 2016 | archive-url=https://web.archive.org/web/20161215005332/http://arstechnica.com/security/2016/09/yahoo-says-half-a-billion-accounts-breached-by-nation-sponsored-hackers/ | url-status=live }}

From October 2014 to at least November 2016, Belan and at least two hackers connected to him accessed user account information and contents for various unlawful actions including searching emails for gift voucher codes, deliberately targeting the accounts of persons of interest, improving the search ranking of businesses they had an interest in, and using the Yahoo data to breach accounts on other platforms such as Gmail. As part of this process, the hackers enlisted Canadian hacker Karim Baratov to break into accounts on other platforms.{{cite web |last1=Perlroth |first1=Nicole |last2=Goel |first2=Vindu |date=September 28, 2016 |title=Defending Against Hackers Took a Back Seat at Yahoo, Insiders Say |url=https://www.nytimes.com/2016/09/29/technology/yahoo-data-breach-hacking.html?_r=0 |url-status=live |archive-url=https://web.archive.org/web/20161215205623/http://www.nytimes.com/2016/09/29/technology/yahoo-data-breach-hacking.html?_r=0 |archive-date=December 15, 2016 |access-date=December 15, 2016 |work=The New York Times}}{{cite journal |last1=Shankar |first1=Nithya |last2=Mohammed |first2=Zareef |year=2020 |title=Surviving Data Breaches: A Multiple Case Study Analysis |journal=Journal of Comparative International Management |volume=23 |pages=35–54 |doi=10.7202/1071508ar|doi-access=free }}

July 2016 to October 2017: public disclosures

In June 2016, it was reported that account names and passwords for about 200 million Yahoo accounts were presented for sale on the darknet market site TheRealDeal.{{cite web |last=Cox |first=Joseph |date=August 1, 2016 |title=Yahoo 'Aware' Hacker Is Advertising 200 Million Supposed Accounts on Dark Web |url=https://www.vice.com/en/article/yahoo-supposed-data-breach-200-million-credentials-dark-web/ |url-status=live |archive-url=https://web.archive.org/web/20161215210247/https://motherboard.vice.com/read/yahoo-supposed-data-breach-200-million-credentials-dark-web |archive-date=December 15, 2016 |access-date=December 16, 2016 |work=Vice}} Yahoo stated it was aware of the data and was evaluating it, cautioning users about the situation but did not reset account passwords at that time.

Yahoo officially reported the 2014 breach to the public on September 22, 2016. Yahoo's actions to deal with the breach included invalidating unencrypted security questions and answers and asking potentially affected users to change their passwords.{{Cite web |date=2016-09-22 |title=An Important Message to Yahoo Users on Security |url=https://www.businesswire.com/news/home/20160922006198/en/An-Important-Message-to-Yahoo-Users-on-Security |access-date=2024-03-26 |website=www.businesswire.com |language=en}} Yahoo also claimed that there was no evidence that the attackers were still in the system and that the attack was state-sponsored. The Federal Bureau of Investigation (FBI) confirmed that it was investigating the matter.{{cite news |date=September 23, 2016 |title=Yahoo 'state' hackers stole data from 500 million users |url=https://www.bbc.co.uk/news/world-us-canada-37447016 |url-status=live |archive-url=https://web.archive.org/web/20160923002317/http://www.bbc.co.uk/news/world-us-canada-37447016 |archive-date=September 23, 2016 |access-date=September 23, 2016 |publisher=BBC News}} The Wall Street Journal reported that a security firm, which had access to a portion of Yahoo's database, believed that the attackers were criminal in nature rather than state sponsored, and that the database had been sold repeatedly.{{Cite news |last=McMillan |first=Robert |title=Yahoo Hackers Were Criminals Rather Than State-Sponsored, Security Firm Says |url=https://www.wsj.com/articles/yahoo-hackers-were-criminals-rather-than-state-sponsored-security-firm-says-1475081065 |access-date=2024-05-27 |work=WSJ |language=en-US}}

In its November 2016 U.S. Securities and Exchange Commission (SEC) filing, Yahoo reported they had been aware of an intrusion into its network in 2014, but had not understood the extent of the breach until it began an investigation of a separate data breach incident around July 2016.{{cite news|title=Yahoo discovered hack leading to major data breach two years before it was disclosed|url=https://www.washingtonpost.com/news/the-switch/wp/2016/11/10/yahoo-discovered-hack-leading-to-major-data-breach-two-years-before-it-was-disclosed/|newspaper=The Washington Post|access-date=November 10, 2016|archive-date=November 11, 2016|archive-url=https://web.archive.org/web/20161111002926/https://www.washingtonpost.com/news/the-switch/wp/2016/11/10/yahoo-discovered-hack-leading-to-major-data-breach-two-years-before-it-was-disclosed/|url-status=live}}{{cite news|title=Yahoo Employees Knew in 2014 About State-Sponsored Hacker Attack|url=https://www.nytimes.com/2016/11/10/technology/yahoo-employees-knew-in-2014-about-hacker-attack.html|work=The New York Times|date=November 10, 2016 |access-date=November 10, 2016|archive-date=November 10, 2016|archive-url=https://web.archive.org/web/20161110033706/http://www.nytimes.com/2016/11/10/technology/yahoo-employees-knew-in-2014-about-hacker-attack.html|url-status=live|last1=Goel |first1=Vindu }} Yahoo's previous SEC filing on September 9, prior to the breach announcement, had stated that it was not aware of any "security breaches" or "loss, theft, unauthorized access or acquisition" of user data.{{cite news|last1=McMillan|first1=Robert|title=Yahoo Hackers Were Criminals Rather Than State-Sponsored, Security Firm Says|newspaper=WSJ |url=https://www.wsj.com/articles/yahoo-hackers-were-criminals-rather-than-state-sponsored-security-firm-says-1475081065|publisher=The Wall Street Journal|access-date=October 15, 2016|archive-date=October 15, 2016|archive-url=https://web.archive.org/web/20161015064124/http://www.wsj.com/articles/yahoo-hackers-were-criminals-rather-than-state-sponsored-security-firm-says-1475081065|url-status=live}} The November filing noted that the company believed one of the data breaches had been conducted through a cookie-based attack that allowed hackers to authenticate as any other user without their password.{{cite news|title=Yahoo knew of 'state-backed' hack in 2014|work=BBC News |date=November 10, 2016 |url=https://www.bbc.co.uk/news/technology-37936219|access-date=November 10, 2016|archive-date=November 10, 2016|archive-url=https://web.archive.org/web/20161110153256/http://www.bbc.co.uk/news/technology-37936219|url-status=live}}{{cite web|last1=Vaas|first1=Lisa|title=Yahoo staff knew they were breached two years ago|date=November 11, 2016 |url=https://nakedsecurity.sophos.com/2016/11/11/yahoo-staff-knew-they-were-breached-two-years-ago/|publisher=Naked Security|access-date=December 12, 2016|archive-date=December 17, 2016|archive-url=https://web.archive.org/web/20161217075432/https://nakedsecurity.sophos.com/2016/11/11/yahoo-staff-knew-they-were-breached-two-years-ago/|url-status=live}} (In an SEC regulatory filing in 2017, Yahoo reported that 32 million accounts were accessed through this cookie-based attack through 2015 and 2016.{{Cite web |last=Lawler |first=Richard |date=March 1, 2017 |title=Yahoo hackers accessed 32 million accounts with forged cookies |url=https://www.engadget.com/2017/03/01/yahoo-hackers-accessed-32-million-accounts-with-forged-cookies/ |url-status=live |archive-url=https://web.archive.org/web/20170302043137/https://www.engadget.com/2017/03/01/yahoo-hackers-accessed-32-million-accounts-with-forged-cookies/ |archive-date=March 2, 2017 |access-date=March 1, 2017 |work=Engadget}})

In December 2016, Yahoo disclosed the 2013 breach, and that one billion user accounts had been compromised.{{Cite news |last=Rushe |first=Dominic |date=2017-10-03 |title=Yahoo says all of its 3bn accounts were affected by 2013 hacking |url=https://www.theguardian.com/technology/2017/oct/03/yahoo-says-all-of-its-3bn-accounts-were-affected-by-2013-hacking |access-date=2024-03-26 |work=The Guardian |language=en-GB |issn=0261-3077}} Almost a year later, in October 2017 they revised that estimate and reported that all three billion Yahoo accounts had been compromised in the breach.

Yahoo's internal review of the situation found that Mayer and other key executives knew of the intrusions but failed to inform the company or take steps to prevent further breaches. The review led to the resignation of the company's General Counsel, Ronald S. Bell by March 2017, and Mayer's $12 million equity compensation and bonus for 2016 and 2017 was pulled.{{cite web |last=Goel |first=Vindu |date=March 1, 2017 |title=Yahoo's Top Lawyer Resigns and C.E.O. Marissa Mayer Loses Bonus in Wake of Hack |url=https://www.nytimes.com/2017/03/01/technology/yahoo-hack-lawyer-resigns-ceo-bonus.html |url-status=live |archive-url=https://web.archive.org/web/20170316013736/https://www.nytimes.com/2017/03/01/technology/yahoo-hack-lawyer-resigns-ceo-bonus.html |archive-date=March 16, 2017 |access-date=March 15, 2017 |work=The New York Times}}

Prosecution

File:Dmitry_Dokuchaev.jpg agent Dmitry Dokuchaev who has been charged with the breach by the FBI ]]

On March 15, 2017, the FBI charged four men with the 2014 breach, including two that were working for Russia's Federal Security Service (FSB). In its statement, the FBI said "The criminal conduct at issue, carried out and otherwise facilitated by officers from an FSB unit that serves as the FBI's point of contact in Moscow on cybercrime matters, is beyond the pale."{{cite web | title=Russian Agents Were Behind Yahoo Breach, U.S. Says | url=https://www.nytimes.com/2017/03/15/technology/yahoo-hack-indictment.html?_r=0 | first=Vindu | last=Goel | date=March 15, 2017 | access-date=March 15, 2017 | work=The New York Times | archive-date=March 16, 2017 | archive-url=https://web.archive.org/web/20170316013628/https://www.nytimes.com/2017/03/15/technology/yahoo-hack-indictment.html?_r=0 | url-status=live }}

The four men accused include hacker Alexsey Belan who was on the FBI Ten Most Wanted Fugitives list, FSB agents Dmitry Dokuchaev and Igor Sechin who the FBI accused of paying Belan and other hackers to conduct the hack, and Canadian hacker Karim Baratov. The FBI claimed that Dokuchaev and Sushchin paid Karim Baratov to use data obtained by the Yahoo breaches to break into about 80 non-Yahoo accounts of specific targets.{{cite web | url=https://www.reuters.com/article/us-yahoo-cyber/canadian-charged-in-yahoo-hacking-case-to-plead-guilty-in-u-s-idUSKBN1DO2PJ | title=Canadian charged in Yahoo hacking case to plead guilty in U.S. | first=Nate | last=Raymond | date=November 24, 2017 | access-date=November 27, 2017 | publisher=Reuters | archive-date=November 26, 2017 | archive-url=https://web.archive.org/web/20171126105049/https://www.reuters.com/article/us-yahoo-cyber/canadian-charged-in-yahoo-hacking-case-to-plead-guilty-in-u-s-idUSKBN1DO2PJ | url-status=live }} Russian officials have denied any involvement.{{cite web |last=Braga |first=Matthew |date=2017-03-17 |title=Here's how the FBI says Russian hackers stole Yahoo account secrets |url=https://www.cbc.ca/news/science/russian-yahoo-hackers-indictment-500-million-emails-how-1.4029532 |access-date=2024-05-01 |publisher=CBC News |quote=Using a variety of techniques to bypass security measures, hackers sought access to myriad email accounts}}{{Cite news |last=Eckel |first=Mike |last2=Schreck |first2=Carl |date=2017-03-18 |title=Undercover FSB Officer Indicted By U.S. Worked For Moscow Investment Bank |url=https://www.rferl.org/a/russia-fsb-officer-indicted-worked-moscow-investment-bank/28377570.html |access-date=2024-05-01 |work=Radio Free Europe/Radio Liberty |language=en}}

Baratov, the only man arrested, was extradited to the United States in August 2017.{{Cite web |last=Bennett |first=Kelly |title=Karim Baratov, alleged Yahoo hacker, pleads not guilty in U.S. court |url=https://www.cbc.ca/news/canada/hamilton/karim-baratov-alleged-yahoo-hacker-pleads-not-guilty-in-u-s-court-1.4259623}} He pled guilty, admitting to hacking into at least 80 email accounts on behalf of Russian contacts. He was charged with nine counts of hacking, and in May 2018 sentenced to 5 years in prison and ordered to pay $2.25 million and restitution to his victims.{{cite web | url = https://www.engadget.com/2018/05/30/yahoo-hacker-sentence/ | title = Attacker involved in 2014 Yahoo hack gets five years in prison | first = Mariella | last = Moon | date = May 30, 2018 | access-date = May 30, 2018 | work = Engadget | archive-date = May 31, 2018 | archive-url = https://web.archive.org/web/20180531020408/https://www.engadget.com/2018/05/30/yahoo-hacker-sentence/ | url-status = live }} His memoir, published in 2023, describes a party lifestyle funded by hacking into email accounts of thousands of people.{{Cite book |last=Baratov |first=Karim |url=https://www.amazon.co.uk/Disconnected-Memoir-Hacker-Karim-Baratov-ebook/dp/B0BSVHWKS9/ref=tmm_kin_swatch_0?_encoding=UTF8&qid=&sr= |title=Disconnected: A Memoir of the Yahoo Hacker |year=2023 |access-date=2024-03-26}}

Reactions and criticism

Yahoo's delay in discovering and reporting these breaches, as well as implementing improved security features, has been roundly criticized at all levels.{{cite web | url=http://fortune.com/2016/12/19/yahoo-hack-cyber-security/ | title=Why Yahoo's Security Problems Are a Story of Too Little, Too Late | date=December 19, 2016 | access-date=December 19, 2016 | agency=Reuters | archive-date=December 19, 2016 | archive-url=https://web.archive.org/web/20161219093816/http://fortune.com/2016/12/19/yahoo-hack-cyber-security/ | url-status=live }}

=Verizon Communications deal=

Before the announcement of the breaches Verizon Communications had entered into negotiations and approval to purchase a portion of the Yahoo properties for $4.8 billion, with the deal set to close in March 2017.{{cite news |last=Larson |first=Selena |date=September 23, 2016 |title=Yahoo facing lawsuits in the wake of massive data breach |url=https://money.cnn.com/2016/09/23/news/companies/yahoo-sued-data-breach/ |url-status=live |archive-url=https://web.archive.org/web/20160925141410/http://money.cnn.com/2016/09/23/news/companies/yahoo-sued-data-breach/ |archive-date=September 25, 2016 |access-date=September 25, 2016 |publisher=CNN}} Yahoo only disclosed the 2014 breach to Verizon two days prior to the Yahoo's September announcement. Verizon CEO Lowell McAdam said he wasn't shocked by the hack, saying "we all live in an internet world, it's not a question of if you're going to get hacked but when you are going to get hacked".{{cite news |last1=Knutson |first1=Ryan |last2=Wells |first2=Georgia |title=Verizon CEO Says Evaluating Whether Yahoo Hack Had 'Material Impact' |url=https://www.wsj.com/articles/verizon-ceo-says-evaluating-whether-yahoo-hack-had-material-impact-1476136610 |access-date=23 March 2023 |work=The Wall Street Journal |date=10 October 2016 |id={{ProQuest|1827509919}} |url-access=subscription |archive-date=February 22, 2017 |archive-url=https://web.archive.org/web/20170222133308/https://www.wsj.com/articles/verizon-ceo-says-evaluating-whether-yahoo-hack-had-material-impact-1476136610 |url-status=live }} In February 2017, Verizon and Yahoo announced that the deal will still go forward, but dropping the sale price by $350 million, down to $4.48 billion.{{Cite web|title=Yahoo Data Breach: What Actually Happened?|url=https://bpbonline.com/blogs/news/yahoo-data-breach-what-actually-happened|access-date=2021-04-28|website=BPB Online|language=en|archive-date=April 28, 2021|archive-url=https://web.archive.org/web/20210428055904/https://bpbonline.com/blogs/news/yahoo-data-breach-what-actually-happened|url-status=live}} The deal officially closed at this price in June 2017, with Mayer stepping down as CEO following the closure.{{cite web | url=https://www.reuters.com/article/us-yahoo-m-a-verizon-idUSKBN194220 | title=Verizon closes Yahoo deal, Mayer steps down | date=June 14, 2017 | access-date=June 14, 2017 | work=Reuters | archive-date=June 13, 2017 | archive-url=https://web.archive.org/web/20170613234458/http://www.reuters.com/article/us-yahoo-m-a-verizon-idUSKBN194220 | url-status=live }} Verizon and Yahoo agreed to jointly share ongoing costs for the government investigation of the breaches under this new term.{{cite web | url=https://www.cnbc.com/2017/02/21/verizon-yahoo-agree-to-cut-merger-price.html | title=Verizon revises deal with Yahoo to $4.48 billion | agency=Reuters | via=CNBC | date=February 21, 2017 | access-date=February 21, 2017 | archive-date=February 22, 2017 | archive-url=https://web.archive.org/web/20170222105957/http://www.cnbc.com/2017/02/21/verizon-yahoo-agree-to-cut-merger-price.html | url-status=live }} The Yahoo company, which still held those properties not purchased by Verizon, was renamed to Altaba in June 2017.{{Cite web | url = https://money.cnn.com/2017/06/19/investing/yahoo-altaba-stock/index.html | title = So long, Yahoo. Hello ... Altaba? | first = Paul | last = La Monica | date = June 19, 2017 | access-date = April 24, 2018 | work = CNN | archive-date = April 13, 2018 | archive-url = https://web.archive.org/web/20180413140654/http://money.cnn.com/2017/06/19/investing/yahoo-altaba-stock/index.html | url-status = live }} As Altaba was the original company, it was Altaba that was subject to a later $35 million fine from the SEC rather than Verizon.{{Cite web |last=Kastrenakes |first=Jacob |date=2017-01-10 |title=Yahoo isn't really going away (at least, not yet) |url=https://www.theverge.com/2017/1/9/14219914/marissa-mayer-isnt-leaving-yahoo-yet-altaba-rename |access-date=2024-04-02 |website=The Verge |language=en}}

=United States government=

In a letter to Mayer, six U.S. Senators (Elizabeth Warren, Patrick Leahy, Al Franken, Richard Blumenthal, Ron Wyden and Ed Markey) demanded answers on when Yahoo discovered the last 2014 breach, and why it took so long to disclose it to the public, calling the time lag between the security breach and its disclosure "unacceptable".{{cite web|title=Letter to Marissa Mayer signed by 6 senators|url=https://www.leahy.senate.gov/imo/media/doc/9-27-16%20Yahoo%20Breach%20Letter.pdf|website=leahy.senate.gov|access-date=September 30, 2016|archive-date=October 3, 2016|archive-url=https://web.archive.org/web/20161003140602/https://www.leahy.senate.gov/imo/media/doc/9-27-16%20Yahoo%20Breach%20Letter.pdf|url-status=live}}{{cite web|last1=Fisher|first1=Dennis|title=Senators Demand Answers of Mayer on Yahoo Data Breach|url=https://www.onthewire.io/senators-demand-answers-of-mayer-on-yahoo-data-breach/|publisher=OnTheWire|access-date=September 30, 2016|date=28 September 2016|archive-date=October 2, 2016|archive-url=https://web.archive.org/web/20161002162913/https://www.onthewire.io/senators-demand-answers-of-mayer-on-yahoo-data-breach/|url-status=live}}{{cite news|last1=Kuchler|first1=Hannah|title=US senators demand answers from Yahoo|url=http://www.ft.com/cms/s/0/36fd9132-84e1-11e6-a29c-6e7d9515ad15.html|newspaper=The Financial Times|date=September 27, 2016 |access-date=September 30, 2016|url-access=subscription|archive-date=March 23, 2023|archive-url=https://web.archive.org/web/20230323184159/https://www.ft.com/content/36fd9132-84e1-11e6-a29c-6e7d9515ad15|url-status=live}} On September 26, 2016, senator Mark Warner asked the U.S. Securities and Exchange Commission (SEC) to investigate whether Yahoo and its senior executives fulfilled their obligations under federal securities laws to properly disclose the attack. In 2017, the SEC announced a $35 million fine against Altaba for failure to disclose the 2014 breach in a timely manner.{{cite web |last=Kastrenakes |first=Jacob |date=April 24, 2018 |title=SEC issues $35 million fine over Yahoo failing to disclose data breach |url=https://www.theverge.com/2018/4/24/17275994/yahoo-sec-fine-2014-data-breach-35-million |url-status=live |archive-url=https://web.archive.org/web/20180424182229/https://www.theverge.com/2018/4/24/17275994/yahoo-sec-fine-2014-data-breach-35-million |archive-date=April 24, 2018 |access-date=April 24, 2018 |work=The Verge}}{{Cite news |last=Merle |first=Renae |date=2021-10-23 |title=Yahoo fined $35 million for failing to disclose cyber breach |url=https://www.washingtonpost.com/news/business/wp/2018/04/24/yahoo-fined-35-million-for-failing-to-disclose-cyber-breach/ |access-date=2024-04-02 |newspaper=Washington Post |language=en-US |issn=0190-8286}}

=Class action lawsuits=

In November 2016, it was reported that 23 lawsuits related to the late 2014 breach had been filed against Yahoo. In one lawsuit, filed in the U.S. District Court for the Southern District of California in San Diego, the plaintiffs contended that the hack caused an "intrusion into personal financial matters."{{Cite web |last=Larson |first=Selena |date=2016-09-23 |title=Yahoo facing lawsuits in the wake of massive data breach |url=https://money.cnn.com/2016/09/23/news/companies/yahoo-sued-data-breach/index.html |access-date=2024-05-27 |website=CNNMoney}}

Five of these 23 cases were combined into a single suit in early December 2016.{{Cite web | url=http://www.siliconbeat.com/2016/12/08/yahoo-data-breach-class-action-suits-joined-together-in-san-jose-federal-court/ | title=Yahoo data-breach class-action lawsuits joined together in San Jose federal court | first=Ethan | last=Baron | date=December 8, 2016 | access-date=December 15, 2016 | work=Silicon Beat | archive-date=December 11, 2016 | archive-url=https://web.archive.org/web/20161211105052/http://www.siliconbeat.com/2016/12/08/yahoo-data-breach-class-action-suits-joined-together-in-san-jose-federal-court/ | url-status=live }}{{cite web | url=https://www.reuters.com/article/us-verizon-yahoo-breach/yahoo-must-face-litigation-by-data-breach-victims-u-s-judge-idUSKCN1BB25Q | title=Yahoo must face litigation by data breach victims: U.S. judge | first=Jonathan | last=Stempel | date=August 31, 2017 | access-date=August 31, 2017 | work=Reuters | archive-date=September 1, 2017 | archive-url=https://web.archive.org/web/20170901065505/http://www.reuters.com/article/us-verizon-yahoo-breach/yahoo-must-face-litigation-by-data-breach-victims-u-s-judge-idUSKCN1BB25Q | url-status=live }} The case was later amended to include the updated breach information following Yahoo's announcement about the August 2013 breach.{{cite web | url = https://www.reuters.com/article/us-verizon-yahoo-breach/data-breach-victims-can-sue-yahoo-in-the-united-states-judge-idUSKCN1GO1TL | title = Data breach victims can sue Yahoo in the United States: judge | first = Jonathan | last = Stempel | date = March 12, 2018 | access-date = March 12, 2018 | publisher = Reuters | archive-date = March 12, 2018 | archive-url = https://web.archive.org/web/20180312163332/https://www.reuters.com/article/us-verizon-yahoo-breach/data-breach-victims-can-sue-yahoo-in-the-united-states-judge-idUSKCN1GO1TL | url-status = live }} Before a trial could commence, Verizon and Altaba agreed to split the cost of a $50 million settlement in October 2018 with those in the class action (an estimated 200 million total users), along with providing two years of free credit monitoring.{{cite web | url = https://abcnews.go.com/Technology/wireStory/yahoo-pay-50m-costs-massive-security-breach-58693643 | title = Yahoo to pay $50M, other costs for massive security breach | first = Michael | last = Liedtke | date = October 23, 2018 | access-date = October 23, 2018 | work = ABC News | archive-date = October 23, 2018 | archive-url = https://web.archive.org/web/20181023215445/https://abcnews.go.com/Technology/wireStory/yahoo-pay-50m-costs-massive-security-breach-58693643 | url-status = live }} The judge rejected the settlement offer, questioning the lack of transparency of the details of the settlements, as well as high costs recouped by the lawyers through the settlement.{{cite web | url = https://www.engadget.com/2019/01/29/judge-tosses-yahoo-data-breach-settlement/ | title = Judge rejects Yahoo's proposed settlement over data breaches | first = Jon | last = Fingas | date = January 29, 2019 | access-date = January 29, 2019 | work = Engadget | archive-date = January 29, 2019 | archive-url = https://web.archive.org/web/20190129195719/https://www.engadget.com/2019/01/29/judge-tosses-yahoo-data-breach-settlement/ | url-status = live }} Yahoo agreed to settle for $117.5 million in April 2019, again offering affected users credit monitoring and a cash payout that depended on the number of respondents in the class.{{cite web | url = https://arstechnica.com/tech-policy/2019/04/yahoo-tries-to-settle-3-billion-account-data-breach-with-118-million-payout/ | title = Yahoo tries to settle 3-billion-account data breach with $118 million payout | first = Jon | last = Brodkin | date = April 10, 2019 | access-date = October 1, 2019 | work = Ars Technica | archive-date = October 1, 2019 | archive-url = https://web.archive.org/web/20191001162656/https://arstechnica.com/tech-policy/2019/04/yahoo-tries-to-settle-3-billion-account-data-breach-with-118-million-payout/ | url-status = live }}

=International=

Foreign governments have also shown concerns on the several data breaches. In October 2016 the European privacy regulators Article 29 Data Protection Working Party outlined concerns about the 2014 data breach as well as allegations that the company built a system that scanned customers' incoming emails at the request of U.S. intelligence services in a letter to Yahoo.{{cite web|title=ARTICLE 29 Data Protection Working Party Letter To Yahoo!|url=http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/files/2016/20161027__letter_of_the_chair_of_the_art_29_wp_yahoo_en.pdf|access-date=November 2, 2016|archive-date=November 4, 2016|archive-url=https://web.archive.org/web/20161104050113/http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/files/2016/20161027__letter_of_the_chair_of_the_art_29_wp_yahoo_en.pdf|url-status=live}}{{cite news |last1=Drozdiak |first1=Natalia |title=EU Issues Data-Protection Warning to WhatsApp, Yahoo |url=https://www.wsj.com/articles/eu-issues-data-protection-warning-to-whatsapp-yahoo-1477647543 |access-date=23 March 2023 |work=The Wall Street Journal |date=28 October 2016 |url-access=subscription |id={{ProQuest|1833042031}} |archive-date=January 4, 2017 |archive-url=https://web.archive.org/web/20170104052245/http://www.wsj.com/articles/eu-issues-data-protection-warning-to-whatsapp-yahoo-1477647543 |url-status=live }} They asked Yahoo to communicate all aspects of the data breach to the European Union authorities, to notify the affected users of the "adverse effects" and to cooperate with all "upcoming national data protection authorities' enquiries and/or investigations".{{cite news|last1=Fioretti|first1=Julia|title=EU data protection watchdogs warn WhatsApp, Yahoo on privacy|date=October 28, 2016 |url=https://www.reuters.com/article/us-eu-dataprotection-whatsapp-yahoo-idUSKCN12S0X5|work=Reuters|access-date=October 29, 2016|archive-date=October 29, 2016|archive-url=https://web.archive.org/web/20161029014210/http://www.reuters.com/article/us-eu-dataprotection-whatsapp-yahoo-idUSKCN12S0X5|url-status=live}} Ireland's Data Protection Commissioner, (the lead European regulator on privacy issues for Yahoo because Yahoo's European headquarters are in Dublin), investigated the breach and issued a statement that "Yahoo’s oversight of the data processing operations performed by its data processor did not meet the standard required by EU data protection law" and that "Yahoo did not take sufficient reasonable steps to ensure that the data processor it engaged complied with appropriate technical security and organisational measures as required by data protection law", although no fine was issued.{{Cite web |title=Data Protection Commission |url=https://www.dataprotection.ie/news-media/press-releases/Data-Protection-Commission-concludes-investigation-into-Yahoo-Data-Breach |access-date=2024-05-27 |website=Data Protection Commission |language=en}} Germany's Federal Office for Information Security criticized Yahoo following the December 2016 announcement, stating "security is not a foreign concept", and warned government and other German users to seek email and internet solutions from companies with better security approaches.{{cite web | url=http://fortune.com/2016/12/15/germany-yahoo-hack/ | title=Germany Slams Yahoo Over Cybersecurity Practices | date=December 15, 2016 | access-date=December 15, 2016 | agency=Reuters | archive-date=December 16, 2016 | archive-url=https://web.archive.org/web/20161216043445/http://fortune.com/2016/12/15/germany-yahoo-hack/ | url-status=live }}