Yahoo hides a 2013 breach for three years, and the bill arrives in the Verizon deal

In August 2013, intruders tied to Russian state-sponsored hackers broke into Yahoo and stole data tied to every one of the company's roughly 3 billion accounts. The attack went largely undisclosed for more than three years. It was only in September 2016 — weeks after Verizon had agreed to buy Yahoo — that the company admitted a 2014 breach of 500 million accounts, and only in December 2016 that it confirmed the far larger 2013 intrusion of all 3 billion accounts.

The timing destroyed the value of the pending sale. Verizon had agreed in July 2016 to acquire Yahoo for $4.8 billion, but the disclosures landed after the deal was signed. Verizon ultimately negotiated a $350 million cut to the purchase price, closing the acquisition at about $4.48 billion in June 2017. The company's valuation had been so eroded that the remaining Yahoo assets were later folded into a vehicle called Altaba.

The regulatory and legal costs followed. In 2018 the SEC charged the company, then Altaba, with failing to properly disclose the breach to investors in its public filings, and it paid a $35 million penalty. In April 2019, Yahoo agreed to pay $117.5 million to settle a class-action lawsuit brought by account holders whose data had been exposed.

The decision at the heart of the case is the decision to withhold material information for years. Yahoo appears to have known of the 2013 intrusion soon after it happened but did not tell users or investors, and the deception is what turned a large hack into an even larger financial and reputational disaster.