Well, This Is Embarrassing

Yahoo Hack Means Verizon Has Some Rethinking to Do

We frequently read about hacks in the news, but by any standard, the cyber-attack at Yahoo is a big one. More than 500 million Yahoo accounts were breached in a recently reported hack that took place in 2014. This means that more than 10 percent of the world’s Internet population has been affected.

According to Yahoo’s own blog entry on the offense, private information exposed includes names, e-mail addresses, telephone numbers and dates of birth. Yahoo says that passwords, although stolen, were encrypted. Nonetheless, Yahoo’s recommendation to affected users is to promptly change their passwords.

Furthermore, the Internet company recommends that users switch away from using a password to a Yahoo Account Key — a multifactor authentication method that pushes a code to a user’s phone. The move away from passwords for authentication purposes is a trend CCS Insight has highlighted several times (see The Evolution of Multifactor Authentication).

For Verizon, which agreed this past summer to acquire Yahoo’s primary Internet assets for $4.8 billion, news of the hack appear to have been unexpected. Liability from the breach could port over to Verizon adding additional risk and uncertainly to the deal. If the agreement goes through, it could lead to a painful case of buyer’s regret.

Given news of class-action lawsuits against Yahoo, some of which are already under way, the potential of additional liability could allow Verizon to pull Yahoo back to the bargaining table. In some countries, Yahoo or its partners could automatically be held accountable for damages. In the UK, for example, the Data Protection Act could mean claims up to £1,000 per affected customer.

Verizon, by some metrics the largest wireless carrier in the US, has been gathering Internet media assets during the past few years. This includes large, established companies — Verizon acquired AOL for $4.4 billion in early 2015 — and smaller start-ups. Fearing commoditised connectivity, Verizon is looking to expand its presence across services and content. AOL combined with Yahoo would make Verizon a major competitor in this space. Expanding into digital media and advertising will require a new type of expertise and thinking from a company with its legacy in telecommunication services.

Combining large companies carries a level of risk, and the hacking attack adds another dimension if the deal with Verizon is completed. It’s not entirely clear why Yahoo made news of the breach public two years after the event, which took place well before discussions with potential suitors began. Yahoo says the breach is a “complex” problem that is being investigated. Verizon said it’s evaluating the situation.

Other companies were also in talks with Yahoo, including AT&T, and there would certainly be ongoing interest for Yahoo’s Internet real estate from some potential buyers. Verizon is unlikely to alter its strategy of morphing into a more-expansive digital company; abandoning its deal with Yahoo entirely seems improbable at this point. One windfall of the deal will be the painful and expensive lessons learned.