The Wall Street Journal – December 14, 2016
By: Robert McMillan, Ryan Knutson and Deepa Seetharaman
A newly discovered data breach exposed the private information of more than 1 billion Yahoo users, the company said, dwarfing the scope of another recently disclosed hack and casting doubt on Verizon Communications Inc.’s planned acquisition of the internet company.
The 2013 theft is separate and twice as large as a 2014 hack that Yahoo Inc. disclosed earlier this year. That hack had been billed as likely the largest-ever theft of personal data.
Unidentified hackers penetrated Yahoo’s network in August 2013 and stole data including names, email addresses, telephone numbers, dates of birth and passwords, the company said. Yahoo said it believes the incident is distinct from the 2014 hack, and that the hackers are no longer in its corporate network.
The new disclosure could jeopardize Verizon’s $4.83 billion acquisition of Yahoo’s core internet business, a deal announced in July and expected to close in early 2017. In October, Verizon signaled it could consider the 2014 breach a material event that could allow it to change the deal terms.
The companies were discussing the impact of that first breach when the second was discovered. Verizon learned of the latest breach in the past few weeks, a person familiar with the matter said. The company still has all options on the table, including renegotiating the deal’s price or walking away, the person said.
“We will evaluate the situation as Yahoo continues its investigation,” Verizon said Wednesday. “We will review the impact of this new development before reaching any final conclusions.”
A spokesman said Yahoo is confident in the company’s value and is continuing with its integration plans. “We have been in communication with Verizon leadership throughout the investigation,” he said.
Verizon had been negotiating with Yahoo over how much liability the remaining Yahoo company would shoulder for future liabilities associated with the 2014 hack, people familiar with the matter said. Verizon wasn’t trying to reduce the purchase price of Yahoo because the cost of future liabilities—if any—is unknown, the people said, therefore asking for a price discount would effectively be a bet.
The sides were close to an agreement, the people familiar said, but that has been derailed after the discovery of this latest, larger breach. Now, Verizon will again wait to see how much the hack affects the number of users or the overall value of the company.
Yahoo’s assets, which include websites such as Yahoo Finance, Sports and News, still make strategic sense for Verizon, one of the people said. If Verizon finds that the overall value of Yahoo hasn’t changed, then the issue could be resolved by simply splitting future liabilities.
Yahoo isn’t sure how many records in total were taken during the two incidents, because a subset of the 1 billion stolen in 2013 were likely also taken in 2014, the company spokesman said. Yahoo learned of the 2013 breach in November when law enforcement provided the company with “data files that a third party claimed was Yahoo data.”The 2014 break-in was done by a state-sponsored actor, Yahoo has said, but it isn’t clear who was behind the 2013 incident.
In September, The Wall Street Journal reported that criminals were selling access to a database of user accounts and that portions of that database had been obtained by the security research firm InfoArmor Inc.
In early November, InfoArmor handed over tens of millions of these record to the Federal Bureau of Investigation, the company said Tuesday.
Now Yahoo’s users are again being urged to review all of their online accounts and to change their passwords and security questions and answers for any other accounts on which they use the same or similar information used for their Yahoo account.
It also recommended users avoid clicking links or downloading attachments from suspicious emails and remain cautious of unsolicited communication asking for personal information.
Separately, Yahoo, which had previously disclosed that its outside forensic experts were investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password, said Wednesday it believes an unauthorized third party accessed the company’s proprietary code to learn how to forge cookies.
Yahoo is notifying affected account holders, and has invalidated the forged cookies.
Shares in the company lost more than 2% after hours to $39.91.