Indictments planned for suspects in epic Yahoo hacks

The company mishandled a 2014 hack that resulted in the theft of personal data from more than 500 million users

SAN FRANCISCO: US authorities are poised to issue criminal indictments targeting four people, three of them in Russia, in connection with epic hacking attacks on Yahoo, Bloomberg reported on Tuesday.

Bloomberg cited a person briefed on the matter as saying that one person was being tracked down in Canada and the others were in Russia.

Yahoo chief executive Marissa Mayer lost an annual bonus and the company counsel his job after an investigation showed the company mishandled a 2014 hack that resulted in the theft of personal data from more than 500 million user accounts.

The pioneering Silicon Valley internet firm did not publicly disclose the hack until last September.

An independent committee determined that Yahoo's security team knew about the attack when it happened, the company said in a regulatory filing.



Late that year, senior executives and some legal staff were made aware that "a state-sponsored actor had accessed certain user accounts" by exploiting an account management tool.

"While significant additional security measures were implemented in response to those incidents, it appears certain senior executives did not properly comprehend or investigate," Yahoo said in the filing.

In December, the company admitted to another cyberattack from 2013 that affected more than a billion users.

Yahoo is currently in a deal to sell its core internet business to telecom giant Verizon, which demanded a $350 million discount after the large-scale hacks became public.

Under the revised terms of the delayed deal, Verizon's purchase of Yahoo assets will total $4.48 billion.



The deal with Verizon will end Yahoo's run of more than 20 years as an independent company.

Yahoo is selling its main operating business as a way to separate it from its more valuable stake in the Chinese internet giant Alibaba, which will become a new entity and act as an investment company.

Yahoo still faces probes and lawsuits related to the cyberattacks affecting more than 1.5 billion accounts, and the timing of the disclosures.

US law requires companies that fall victim to such hacks to disclose them as soon as they are deemed to affect stock prices.

The hacks have been a major embarrassment for a former internet leader that has failed to keep up with Google, Facebook and other tech stars.