The Yahoo Data Breaches

Background

Yahoo was, for much of the 2000s and early 2010s, one of the world's largest web portals and email providers, with billions of user accounts accumulated over nearly two decades of operation. By the mid-2010s the company was in commercial decline and in the process of negotiating a sale of its core internet business to Verizon Communications. It was during this period that the scale of historical security failures inside Yahoo's infrastructure came to light.

The Intrusions

Yahoo later determined that its network had been compromised on at least two separate occasions. The first intrusion began in August 2013 and resulted in the theft of data associated with all Yahoo user accounts then in existence, a figure the company eventually revised to three billion accounts. A second, related intrusion occurred in late 2014 and was attributed by Yahoo and U.S. prosecutors to hackers acting on behalf of Russia's Federal Security Service (FSB). In this incident, attackers used forged cookies and stolen proprietary source code to gain access to user accounts without needing passwords, ultimately affecting more than 500 million accounts. The information exposed in the breaches included names, email addresses, telephone numbers, dates of birth, hashed passwords (using the weak MD5 algorithm in many cases), and, for some accounts, encrypted or unencrypted security questions and answers.

Disclosure Timeline

Yahoo did not disclose either intrusion when it occurred. The company first revealed the 2014 breach publicly on September 22, 2016, stating that at least 500 million accounts had been affected, while it was in the midst of the pending Verizon acquisition. In December 2016, Yahoo disclosed a separate, earlier breach dating to August 2013, initially estimating it had affected around one billion accounts. In October 2017, following further investigation aided by outside forensic experts, Yahoo (by then operating as Altaba after the sale of its core business to Verizon) announced that the 2013 breach had in fact compromised all three billion Yahoo accounts that existed at the time, tripling the earlier estimate.

Attribution and Prosecution

On March 15, 2017, the U.S. Department of Justice unsealed an indictment charging four individuals in connection with the 2014 intrusion: Dmitry Dokuchaev and Igor Sushchin, officers of Russia's FSB; Alexsey Belan, a Russian hacker already wanted by the FBI for prior intrusions into U.S. companies; and Karim Baratov, a Canadian and Kazakhstani national. Prosecutors alleged that the FSB officers had protected, directed, and facilitated Belan's criminal hacking activity and used the access it produced for their own intelligence purposes, including targeting the accounts of journalists, government officials, and business executives. Baratov, who used information obtained from the breach to access individual webmail accounts on a for-hire basis, was extradited from Canada, pleaded guilty in 2017, and was sentenced in May 2018 to five years in prison and ordered to pay over $2 million in restitution. The FSB officers and Belan, who remained in Russia, were not brought into U.S. custody.

Corporate and Regulatory Consequences

The breaches had significant commercial and regulatory repercussions for Yahoo. Verizon, which had agreed in July 2016 to acquire Yahoo's core internet business for approximately $4.83 billion, renegotiated the deal after the breaches were disclosed, ultimately closing the acquisition in June 2017 for about $4.48 billion, roughly $350 million less than the original price. In April 2018, the U.S. Securities and Exchange Commission fined Altaba (Yahoo's successor entity) $35 million for failing to disclose the 2014 breach to investors in a timely manner, marking the first SEC enforcement action of its kind against a public company over delayed breach disclosure. Separately, Yahoo/Altaba agreed in 2019 to a $117.5 million class-action settlement to resolve consumer litigation stemming from the breaches, along with commitments to fund credit monitoring services for affected users.

Significance and Legacy

The Yahoo breaches are frequently cited as the largest data breach in history by number of user accounts affected, and they remain a benchmark case study in cybersecurity, corporate disclosure law, and nation-state cyber operations. The incident demonstrated that intelligence services could co-opt criminal hackers to conduct espionage operations at massive scale while blending state and non-state motives, and it helped drive greater regulatory scrutiny of how and when companies must disclose cybersecurity incidents to shareholders and the public.

Timeline

• 2013-08Attackers compromise Yahoo's network, eventually stealing data associated with all Yahoo accounts in existence.
• 2014-12A second intrusion, later attributed to hackers linked to Russia's FSB, compromises more than 500 million Yahoo accounts using forged cookies.
• 2016-07Verizon agrees to acquire Yahoo's core internet business for approximately $4.83 billion.
• 2016-09-22Yahoo publicly discloses the 2014 breach, stating at least 500 million accounts were affected.
• 2016-12Yahoo discloses the separate 2013 breach, initially estimating about one billion accounts affected.
• 2017-02Verizon and Yahoo agree to reduce the acquisition price by roughly $350 million following the breach disclosures.
• 2017-03-15U.S. Department of Justice unseals indictment charging two FSB officers and two hackers, including Alexsey Belan and Karim Baratov, over the 2014 breach.
• 2017-06-13Verizon completes its acquisition of Yahoo's core business for about $4.48 billion.
• 2017-10-03Yahoo (as Altaba) reveals that the 2013 breach in fact affected all three billion Yahoo accounts, tripling its prior estimate.
• 2018-05Karim Baratov is sentenced to five years in prison and ordered to pay over $2 million in restitution.
• 2018-04The SEC fines Altaba $35 million for failing to timely disclose the 2014 breach to investors.
• 2019-04Yahoo/Altaba agrees to a $117.5 million class-action settlement with affected users.