In one of the biggest lawsuit settlements in the United States history, Yahoo Inc. has agreed to pay $50 million in restitution to settle a class-action lawsuit over a data breach in 2013. Altaba, formerly Yahoo, has also agreed to pay $35 million for attorney fee and provide free credit-monitoring services. The company stated that $50 million will be used to compensate consumers for the losses they suffered due to the data breach.
“We are pleased that we were able to reach a settlement with Yahoo, which would provide relief to impacted users and ensure that Yahoo improves its security practices going forward,” said lead plaintiffs’ attorney John Yanchunis of Morgan & Morgan in Tampa, Florida.
The class-action lawsuit relates to a data breach occurred in 2013 that affected three billion accounts worldwide. The company took three years to discover and disclose the breach. Yahoo was hit by another enormous cybersecurity breach in late 2014 that affected 500 million accounts. It was disclosed in September 2016. Due to the severity of the two cyber-attacks, the U.S. telecom firm Verizon lowered its original offer to acquire Yahoo by $350 million and finalized the deal at $4.48 billion in June 2017.
In April 2018, the Securities and Exchange Commission (SEC) revealed that Altaba agreed to pay a $35 million penalty to settle charges for failing to disclose the breach. “Yahoo’s failure to have controls and procedures in place to assess its cyber-disclosure obligations ended up leaving its investors totally in the dark about a massive data breach. Public companies should have controls and procedures in place to properly evaluate cyber incidents and disclose material information to investors,” said Jina Choi, Director of the Securities and Exchange Commission’s San Francisco Regional Office.
