The future of Yahoo, once the darling of the internet, was plunged into crisis on Thursday following the revelation that it has suffered the biggest data hack in history – and took two years to notice.
Yahoo, which was worth $125bn at the height of the dotcom bubble in 1999, was forced to reveal “state sponsored” hackers had stolen data from more than half a billion people across the world.
The data loss, which happened in 2014 but was only recently discovered, is a huge embarrassment to Yahoo and has raised doubts over the future of the 22-year-old firm. The company, whose services are still regularly used by millions of older internet users but has become increasingly irrelevant for younger people, had recently found a saviour in mobile phone giant Verizon which is in the process of buying it for $4.8bn.
However Verizon, which is one of America’s biggest companies, stunned the business world by revealing that Yahoo executives only admitted the data breach two days ago, despite inking the deal in July. The company refused to offer any public reassurance that it would press ahead with the takeover given news of the hack.
“Within the last two days, we were notified of Yahoo’s security incident,” Verizon said in a statement. “We understand that Yahoo is conducting an active investigation of this matter, but we otherwise have limited information and understanding of the impact. We will evaluate as the investigation continues through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities. Until then, we are not in position to further comment.”
The hack, which affected roughly half of all of Yahoo’s users, has raised serious questions about Yahoo’s security and its executives ability to deal with the fallout. Victims include millions of British BT and Sky customers, as those companies outsourced their email services to Yahoo.
Yahoo first found out about the security breach when Vice journalist Joseph Coxcontacted the company on 30 July to warn it that the data was being offered around for sale. Cox told the Guardian that: “Sources in the data trading community sent me the sample before the listing [for the sale of the data] was put up [on the dark web]”.
Shortly after Cox warned Yahoo about the existence of the data, some of it was listed for sale on black-market dark website the Real Deal Marketplace for sale for for three bitcoins (about $1,860). The listing was posted by a notorious cybercriminal known as “Peace”, who had previously sold dumps of MySpace and LinkedIn data.
Yahoo said it was aware of the “claimed” data hack in July. At the time it said Yahoo was “committed to protecting the security of our users’ information and we take any such claim very seriously. Our security team is working to determine the facts”.
US politicians attacked Yahoo for not acting faster to warn users, who will have to change not just their Yahoo password but also any linked accounts which could include social media profiles, photo album sites and financial services. Yahoo reassured users that their credit card details should be safe as they are stored in a different system to the one exposed in the hack.
“While its scale puts it among the largest on record, I am perhaps most troubled by news that this breach occurred in 2014, and yet the public is only learning details of it today,” Democratic senator Mark Warner said. “Action from Congress to create a uniform data breach notification standard so that consumers are notified in a much more timely manner is long overdue.”
Senator Richard Blumenthal, also a Democrat, called for an official investigation to determine “whether Yahoo may have concealed its knowledge of this breach in order to artificially bolster its valuation in its pending acquisition by Verizon”.
“If Yahoo knew about the hack as early as August, and failed to coordinate with law enforcement, taking this long to confirm the breach is a blatant betrayal of their users’ trust,” he said.
Yahoo’s chief information security officer, Bob Lord, said: “Yahoo is working closely with law enforcement on this matter.
“Online intrusions and thefts by state-sponsored actors have become increasingly common across the technology industry,” the company added.
“Yahoo encourages users to review their online accounts for suspicious activity and to change their password and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account,” the company said in an email to users.
Yahoo’s boss, Marissa Mayer, could collect a total of $137m if she leaves the company following the sale to Verizon. Mayer has taken home $78m since she was installed as CEO in 2012, and if she leaves the company after a buyout she is on course for another $59m, based on the terms of the company’s most recent proxy statement.
The data breach, which experts suggest could have been carried out by Russian, Chinese or North Korean sponsored hackers, could end up costing Yahoo more than the $4.8bn it sold itself to Verizon for. Research by the Ponemon Institute, a data and privacy research service, shows the average cost of remediating a data breach is $221 an incident, which would work out as far more than the sale price.
“Yahoo may very well be facing an existential crisis,” said Corey Williams of identity management software company Centrify. “Already besieged by business execution issues and enduring a fire sale to Verizon, this may be the straw that breaks the camel’s back.”
Alex Holden, founder of Hold Security, which has been tracking the flow of Yahoo data on the dark web, said: “The stolen Yahoo data is critical because it not only leads to a single system but to users’ connections to their banks, social media profiles, other financial services and users’ friends and family. This is one of the biggest breaches of people’s privacy and very far reaching.”