500M Accounts Stolen in Yahoo Data Breach

A US senator wants the Securities and Exchange Commission to investigate Yahoo's handling of a major data breach. Mark Warner says the company left the public, and specifically investors, in the dark.

Last week the company announced that it was hit in late 2014 by an attack that it believed to have been backed by a foreign government. Around 500 million accounts were affected and the stolen data included names, email address, dates of birth, phone numbers and passwords.

The good news is that the passwords were encrypted. The bad news is that the data also included security questions and answers, not all of which were encrypted. While the type of data stolen may have varied from account to account, it certainly appears likely there will be many cases where there's enough information for a hacker to access a user's account (including by resetting a password) and/or commit identity theft.

The big question is when Yahoo found out about all of this. Journalists began asking the company about reports of a leak in August, 2016, and some claims say Yahoo itself found out in July of 2016.

Lawsuits Already Filed

The delay in going public with the news is already causing problems for the company. Perhaps inevitably, some users who say they've had sensitive financial information accessed as a result of the breach have already filed lawsuits, and one lawyer believes the case will gain class action status.

Meanwhile Senator Warner wants the SEC to find out if any laws have been broken. He's pointing to a financial filing the company made on September 9 which included the statement "To the knowledge of [Yahoo], there have not been any incidents of, or third party claims alleging, (i) Security Breaches, unauthorized access or unauthorized use of any of Seller's or the Business Subsidiaries' information technology systems." (Source: techcrunch.com)

That seems questionable at best, given reporters say Yahoo specifically confirmed in August 2016 that it was aware of a claimed breach.

SEC Urged To Review Rules

Warner notes that federal law requires publicly traded companies to tell stockholders within four days of a material event, meaning something that could affect the stock's value. To make things worse, the September 9, 2016 statement was made as part of a planned buyout of Yahoo by Verizon.

As well as demanding specific investigation of Yahoo, Warner wants the SEC to examine whether current rules on when a company must report a data breach are tough enough. He notes that since 2010, fewer than 100 among a total of around 9,000 public companies have reported a breach. (Source: senate.gov)

What's Your Opinion?

How quickly should companies report a data breach? Should they wait until they have full confirmation and details or should they make people aware whenever they start investigating a credible claim? Do you use Yahoo and if so are you happy with how they've kept users informed?