Yahoo Agrees to Settlement Following Massive 2013 Data Breach, Including $50M Fund for Victims

[MacRumors]

The data breach that affected all 3 billion Yahoo accounts beginning in 2013 is getting a bit of closure this week, with a settlement agreement between Yahoo and the Northern District Court of California (via Engadget). In the settlement, Yahoo has agreed to put $50 million into a fund for victims of the breach, provide two years of credit monitoring from AllClear, and a few other benefits for victims. The settlement is still awaiting court approval.

Those users who spent time addressing the damage from the breach, and can show documentation that they were affected, will be able to file a complaint. The filing requires users to prove documented losses of time measured in hours, and victims can be awarded $25 per hour for up to 15 hours at a maximum of $375. If the user does not have proof of lost time, they are eligible for up to five hours of compensation reaching $125. Those who paid for a premium Yahoo email account will be able to request a 25 percent refund.

In September 2016, Yahoo first disclosed a 2014 hack in which "at least" 500 million Yahoo accounts were compromised. In December 2016, Yahoo then disclosed a second major hack that affected more than one billion accounts in August 2013 -- the case that this settlement is addressing. Yahoo's new parent company Verizon then explained in October 2017 that all three billion Yahoo accounts that existed at the time were affected in the 2013 hack.

Information stolen from affected accounts in the 2013 data breach included names, email addresses, telephone numbers, birth dates, hashed passwords, and both encrypted and unencrypted security questions and answers. Clear text passwords, bank account information, and credit/debit card information were not believed to have been accessed in the attack.

Verizon said in a statement last year, "We proactively work to ensure the safety and security of our users and networks in an evolving landscape of online threats," further iterating that Yahoo will now "benefit from Verizon's experience and resources" in the field of privacy and security.

Article Link: Yahoo Agrees to Settlement Following Massive 2013 Data Breach, Including $50M Fund for Victims

 

[keysofanxiety]

So that's $0.016 per victim. If you were subject to this breach and win some money, try not to spend it all at once.

 

[OldSchoolMacGuy]

Talk about a micro fine for the largest breach in history.

 

[now i see it]

Problem is... There's no way to know or prove for certain that an identity theft incident was the result of the yahoo breach. Nobody is going to be able to prove that their identity got stolen because of this.

And how is anyone going to prove they lost so many hours trying to rectify the identity theft. Impossible.

This settlement is rediculous.

 

[ArtOfWarfare]

If the user does not have proof of lost time, they are eligible for up to five hours of compensation reaching $125.

Wait - my wife has had a Yahoo account since long before 2013. Can she get the $125? We know her account was compromised, and emails are sent to her Yahoo contacts pretending to be her (easily identified because the emails use her maiden name instead of her married last name) periodically. Is that sufficient to claim the $125?

 

[dannyyankou]

So that's $0.016 per victim. If you were subject to this breach and win some money, try not to spend it all at once.

If you read beyond the first paragraph, you’ll see you can get more than that.

But anyway, how can you possibly document the number of hours looking into a problem like this?

 

[keysofanxiety]

If you read beyond the first paragraph, you’ll see you can get more than that.

Yeah but that would involve reading rather than making a snarky comment.

 

[JosephAW]

Hey that's me. My cc was hacked when I bought something using their store. Had to get new card and spend time on phone with cc co.

 

[jimmirehman]

Wow so all my personal information was given to the world and I get $.016 for it? I think I’m going to get a lawyer. I want the entire $50 million.

 

[HiRez]

Does reading this article count as "looking into the problem"? I'll read real slow.

 

[jimmirehman]

Problem is... There's no way to know or prove for certain that an identity theft incident was the result of the yahoo breach. Nobody is going to be able to prove that their identity got stolen because of this.

And how is anyone going to prove they lost so many hours trying to rectify the identity theft. Impossible.

This settlement is rediculous.

doesn't matter, you cant put a price on your privacy, and if you could, it certainly wouldn't be $.016

 

[justperry]

The data breach that affected all 3 billion Yahoo accounts beginning in 2013 is getting a bit of closure this week, with a settlement agreement between Yahoo and the Northern District Court of California (via Engadget). In the settlement, Yahoo has agreed to put $50 million into a fund for victims of the breach, provide two years of credit monitoring from AllClear, and a few other benefits for victims. The settlement is still awaiting court approval.

Those users who spent time addressing the damage from the breach, and can show documentation that they were affected, will be able to file a complaint. The filing requires users to prove documented losses of time measured in hours, and victims can be awarded $25 per hour for up to 15 hours at a maximum of $375. If the user does not have proof of lost time, they are eligible for up to five hours of compensation reaching $125. Those who paid for a premium Yahoo email account will be able to request a 25 percent refund.

In September 2016, Yahoo first disclosed a 2014 hack in which "at least" 500 million Yahoo accounts were compromised. In December 2016, Yahoo then disclosed a second major hack that affected more than one billion accounts in August 2013 -- the case that this settlement is addressing. Yahoo's new parent company Verizon then explained in October 2017 that all three billion Yahoo accounts that existed at the time were affected in the 2013 hack.

Information stolen from affected accounts in the 2013 data breach included names, email addresses, telephone numbers, birth dates, hashed passwords, and both encrypted and unencrypted security questions and answers. Clear text passwords, bank account information, and credit/debit card information were not believed to have been accessed in the attack.

Verizon said in a statement last year, "We proactively work to ensure the safety and security of our users and networks in an evolving landscape of online threats," further iterating that Yahoo will now "benefit from Verizon's experience and resources" in the field of privacy and security.

Article Link: Yahoo Agrees to Settlement Following Massive 2013 Data Breach, Including $50M Fund for Victims

U.S. citizens only or worldwide?

 

[BaracksPhallusPalace]

a pathetic fine for a pathetic company that was ruined by a pathetic woman (Marissa Mayer)

 

[Chambers McMac]

Is 50 million enough?

 

[fairuz]

a pathetic fine for a pathetic company that was ruined by a pathetic woman (Marissa Mayer)

They were effed before she was CEO. The company should've been killed long before she took the wheel.

 

[SteveW928]

Totally ridiculous amount... peanuts.
Hopefully it gets turned down and they get closer to $1B fine.
And, whatever it ends up being, the word needs to get out so everyone possible can claim it. (Note: it's just money put aside for people who do claim... if few claim, they pay even far less.)

 

[tcador]

They were effed before she was CEO. The company should've been killed long before she took the wheel.

Agree unfortunately. I still like the idea of yahoo from the early days. Sigh.

 

[Solomani]

Does Yahoo even have any money left to pay this settlement?

 

[C DM]

Does Yahoo even have any money left to pay this settlement?

Yahoo! doesn't really exist as a company anymore, just as a brand basically. It would probably be Verizon at this point that would be taking care of this (given that they basically purchased the brand and what's related to it).

 

[ActionableMango]

I'm still astonished that Yahoo has 3 billion user accounts.

 

[fairuz]

Yahoo! doesn't really exist as a company anymore, just as a brand basically. It would probably be Verizon at this point that would be taking care of this (given that they basically purchased the brand and what's related to it).

Yahoo! also had a lot of stake in other companies, including the lucrative bet they placed on Alibaba. I wonder where that stuff went.
[doublepost=1540519032][/doublepost]

I'm still astonished that Yahoo has 3 billion user accounts.

Not surprising if you're including inactive ones too.

 

[C DM]

Yahoo! also had a lot of stake in other companies, including the lucrative bet they placed on Alibaba. I wonder where that stuff went.
[doublepost=1540519032][/doublepost]
Not surprising if you're including inactive ones too.

That got spun off into a different invenstment compaby Altaba. It's possible that might actually be the entity that pays for this settlement, or splits it in some way with Verizon.

 

[ActionableMango]

Yahoo! also had a lot of stake in other companies, including the lucrative bet they placed on Alibaba. I wonder where that stuff went.
[doublepost=1540519032][/doublepost]
Not surprising if you're including inactive ones too.

Oh inactive accounts is a given. It still surprises me.