Some Yahoo Employees Knew About Data Breach in 2014
In September, Yahoo announced a massive data breach, in which the personal information of 500 million users was at risk. The company is now admitting that some employees knew about the breach in 2014.
In a securities filing on Wednesday, Yahoo said they knew a hacker, who was backed by a foreign government, attacked their network in 2014. The company did not say whether the attack was disclosed to senior management at that time. The breach resulted in the theft of 500 million names, birth dates and encrypted passwords.
Uncovering who knew what and when has become a hot issue as the company tries to salvage the sale of its Internet operations to Verizon. Yahoo did not disclose the breach until September 22–two months after it had reached a $4.8 billion deal with Verizon.
Yahoo said it uncovered the data breach–the largest to affect a private company–as it was investigating a hacker’s claim this July. The person reportedly obtained Yahoo user data. Even though Yahoo was investigating these claims, they did not disclose this information to Verizon during negotiations. Last month, Verizon said this new information could diminish the value of Yahoo and that they were considering reopening the deal, which was expected to close in early 2017.
Yahoo has also disclosed new details about the attack. They said the board of directors and forensic experts were looking into “certain evidence and activity that indicates an intruder, believed to be the same state-sponsored actor responsible for the security incident, created cookies that could have enabled such intruder to bypass the need for a password to access certain users’ accounts or account information.”
Law enforcement has started sharing information with Yahoo on November 7 that is allegedly Yahoo user information which a hacker obtained.
Currently, there are 23 lawsuits against Yahoo related to this data breach.
Yahoo has said it is cooperating with federal, state, local and foreign officials to investigate this breach.