In 2013 attackers broke into Yahoo's user database. Yahoo did not disclose it until 2016, during its sale to Verizon, and the number kept growing: 500 million accounts, then one billion, then all three billion in 2017. The attackers used forged login cookies and weak encryption.
The cost: roughly US$350 million cut from the sale price, a US$35 million regulator fine for late disclosure, and a US$117.5 million settlement. The case became the model for today's cyber disclosure rules and for holding security executives personally accountable.
Three lessons still apply. The first number is never the final number. Hiding a breach costs more than the breach. And login sessions and cookies deserve the same protection as passwords.
What it means for your business
- Agree your disclosure process — regulators, customers, board — before an incident.
- Protect session tokens like passwords; rotate keys and watch for anomalies.
- Check cyber risk in every merger or acquisition.
How MTH can help: Our Security Operations service builds incident-response and disclosure playbooks and modernizes identity and session security.
This briefing is original commentary by MTH based on public reporting; figures are as reported by the sources named above and may be revised over time.
