Yahoo 2013-2014: 3 billion accounts, the largest breach in history.

There were two distinct incidents. The first, in August 2013, compromised all 3 billion Yahoo user accounts. The second, in 2014, was a separate state-sponsored intrusion that stole data from more than 500 million accounts. Neither was disclosed publicly at the time.

Yahoo first disclosed the 2014 breach in September 2016, mid-way through its agreement to sell its operating business to Verizon, putting the figure at 500 million accounts. In December 2016 it disclosed the separate 2013 breach, initially estimated at 1 billion accounts, then the largest breach ever reported. In October 2017, after the Verizon deal had closed, Yahoo revised the 2013 figure upward again: the breach had in fact hit every account the company had ever issued, all 3 billion.

The stolen data included names, email addresses, telephone numbers, dates of birth, hashed passwords (the majority bcrypt, some using the weaker MD5), and, critically, security questions and answers, some stored unencrypted. Payment-card and bank-account data were not in the affected systems. In the 2014 intrusion the attackers used stolen credentials and Yahoo's own Account Management Tool to forge web cookies, allowing them to access roughly 32 million accounts without a password, a technique that made the intrusion both durable and hard to detect.

The commonly cited "$470M+" figure reflects the two largest components, the $350M Verizon price reduction and the $117.5M consumer settlement. Adding the $35M SEC penalty and the $29M derivative settlement brings the documented total to roughly $531.5M. The $350M is a reduction in the price an acquirer paid rather than a cash penalty, so treatments that count only cash outflow report a lower figure. Yahoo also does not have a clean post-breach 10-K cumulative-cost line, because the operating company was absorbed into Verizon and the remaining shell was renamed Altaba.

Verizon agreed in July 2016 to buy Yahoo's operating business for $4.83 billion. When the breaches surfaced during due diligence, Verizon used the disclosures to renegotiate. In February 2017 the two companies announced a $350 million reduction, cutting the price to $4.48 billion, a 7.25% discount, and the deal closed in June 2017. It is the most-cited single example of breach cost flowing directly through a company's valuation rather than through fines or litigation.

The renegotiation also restructured post-closing liability. Verizon and the remaining Yahoo entity (renamed Altaba) agreed to share certain cash liabilities from government investigations and third-party litigation relating to the breaches, while Altaba retained sole responsibility for the SEC matter and the shareholder litigation. The episode is now standard teaching material in M&A due diligence: cybersecurity posture is a valuation input, and undisclosed breaches are a repricing event.

On 24 April 2018 the SEC announced a $35 million penalty against Altaba, the entity formerly known as Yahoo! Inc., to settle charges that Yahoo had misled investors by failing to disclose the 2014 breach for nearly two years. Yahoo's information-security team knew of the intrusion and its attribution to a state-sponsored actor within days, yet the company's public filings across 2014 to 2016 disclosed only the risk of a potential breach, not the fact that a massive one had already happened.

It was the first SEC enforcement action ever brought for failing to disclose a data breach. It established that a known, material breach is a reportable event under the securities laws, not merely an operational risk factor, and it directly informed the SEC's later cybersecurity disclosure rulemaking (Item 1.05 of Form 8-K, effective December 2023).

In March 2017 the DOJ indicted four people over the 2014 breach: two officers of Russia's Federal Security Service (FSB), Dmitry Dokuchaev and Igor Sushchin, and two hired hackers, Alexsey Belan and Karim Baratov. It was the first time the United States charged Russian government officials with cyber offenses. Only Baratov, a Canadian citizen, was arrested; he pleaded guilty in November 2017 and in May 2018 was sentenced to five years in prison and a $250,000 fine. The FSB officers and Belan remain in Russia, beyond US reach.

The governance consequences were their own precedent. In January 2019 Yahoo settled a shareholder-derivative suit for $29 million, funded by directors-and-officers insurance, the first time shareholders recovered monetary damages in a data-breach derivative action. An internal investigation faulted senior management and legal for failing to escalate the 2014 intrusion; Yahoo's general counsel resigned, and CEO Marissa Mayer forfeited her 2016 annual bonus and 2017 equity grant. The Verizon transaction closed in June 2017; the remaining Yahoo entity became the holding company Altaba, which wound down over the following years.

Spread across 3 billion accounts, the ~$470M disclosed cost works out to roughly $0.16 per record, orders of magnitude below IBM's per-record benchmarks. That is the fixed-cost amortisation effect at extreme scale: notification, forensics, and legal cost do not scale linearly with record count, so mega-breaches always show low per-record cost. Yahoo sits at the far end of that curve for two additional reasons. Notification came years after the intrusions, collapsing the real-time response cost, and the exposed data was account-credential data rather than the payment-card or medical data that drives the highest per-record settlements. It is the clearest case in the register that "largest breach" by record count and "most expensive breach" by cost are entirely different rankings.