Video: Mozilla chooses Google over Yahoo for US Firefox search Watch Now Yahoo must pay $50 million in damages to victims of one of the largest data breaches on record. On Monday, a settlement was filed with the United States District Court in California which laid to rest the two-year-old lawsuit. Yahoo has agreed to pay $50 million in compensation to victims of the security breach, estimated to be roughly 200 million individuals. In addition, the tech giant will provide a minimum of two years of free credit monitoring to those involved. The settlement relates to two separate breaches, taking place in 2013 and 2014. CNET: White House wants to borrow tech workers from Google, Amazon, says report The first data breach impacted all of Yahoo's three billion accounts. The company said at the time that the theft of source code permitted attackers to access an account at will, even though passwords were not stored in plain text. In the second cyberattack, the firm said 500 million accounts were affected and compromised by a "state actor" who stole user credentials. Names, email addresses, telephone numbers, dates of birth, hashed passwords, and -- in some cases -- encrypted or unencrypted security questions and answers were exposed. TechRepublic: How RATs infect computers with malicious software The data breaches were not disclosed at the time, but rather, in 2016, a delay which sparked anger not only among the general public but also investors. Their impact was catastrophic for Yahoo's reputation and also caused the company a severe headache in relation to an acquisition bid put forward by Verizon. Yahoo was acquired by Verizon in 2016. The original price tag was roughly $4.8 billion, but after the severe security lapse came to light, Yahoo agreed to a discount of $350 million. The deal was finalized in 2017, leading to the resignation of former Yahoo CEO Marissa Mayer. Yahoo's core Internet assets were then merged with AOL, now a Verizon-owned company, and rebranded as Oath. The remaining Yahoo business was rebranded as Altaba. See also: The most interesting Internet-connected vehicle hacks on record Yahoo will pay half of the settlement cost, while Altaba will front the rest of the bill. Altaba has already paid a $35 million fine issued by the US Securities and Exchange Commission (SEC) in penance for Yahoo's failure to disclose the breach to investors in a timely manner. A judge will rule on the settlement on November 29. Previous and related coverage<doc-sep>Yahoo has agreed to pay $50 million in damages and provide two years of free credit-monitoring services to 200 million people whose email addresses and other personal information were stolen as part of the biggest security breach in history. The restitution hinges on federal court approval of a settlement filed late Monday in a 2-year-old lawsuit seeking to hold Yahoo accountable for digital burglaries that occurred in 2013 and 2014, but weren't disclosed until 2016. It adds to the financial fallout from a security lapse that provided a mortifying end to Yahoo's existence as an independent company and former CEO Marissa Mayer's six-year reign. Yahoo revealed the problem after it had already negotiated a $4.83 billion deal to sell its digital services to Verizon Communications. It then had to discount that price by $350 million to reflect its tarnished brand and the specter of other potential costs stemming from the breach. About 3 billion Yahoo accounts were hit by hackers that included some linked to Russia by the FBI . The settlement reached in a San Francisco court covers about 1 billion of those accounts held by an estimated 200 million people in the U.S. and Israel from 2012 through 2016. Claims for a portion of the $50 million fund can be submitted by any eligible Yahoo accountholder who suffered losses resulting from the security breach. The costs can include such things as identity theft, delayed tax refunds or other problems linked to having had personal information pilfered during the Yahoo break-ins. The fund will compensate Yahoo accountholders at a rate of $25 per hour for time spent dealing with issues triggered by the security breach, according to the preliminary settlement. Those with documented losses can ask for up to 15 hours of lost time, or $375. Those who can't document losses can file claims seeking up to five hours, or $125, for their time spent dealing with the breach. Yahoo accountholders who paid $20 to $50 annually for a premium email account will be eligible for a 25 percent refund. The free credit monitoring service from AllClear could end up being the most valuable part of the settlement for most accountholders. The lawyers representing the accountholders pegged the retail value of AllClear's credit-monitoring service at $14.95 per month, or about $359 for two years — but it's unlikely Yahoo will pay that rate. The settlement didn't disclose how much Yahoo had agreed to pay AllClear for covering affected accountholders. The lawyers for Yahoo's accountholders praised the settlement as a positive outcome, given the uncertainty of what might have happened had the case headed to trial. Estimates of damages caused by security breaches vary widely, with experts asserting the value of personal information held in email accounts can range from $1 to $8 per account. Those figures suggest Yahoo could have faced a bill of more than $1 billion had it lost the case. But Yahoo had disputed those damages estimates and noted many of its accountholders submitted false information about their birthdates, names and other parts of their lives when they set up their email. The lawyers representing Yahoo accountholders have a big incentive to get the settlement approved. Yahoo will pay them up to $37.5 million in fees and expenses if it goes through. Oath, the Verizon subsidiary that now oversees Yahoo, didn't respond to requests for comment Tuesday. A hearing to approve the preliminary settlement is scheduled for Nov. 29 before U.S. District Judge Lucy Koh in San Jose, California. If approved, notices will be emailed to affected accountholders and published in People and National Geographic magazines.<doc-sep>
Bottom line: Avoiding a trial was likely in the best interest of all parties, especially Yahoo, as the company could have faced a much larger penalty had it fallen on the wrong side of a verdict. Lawyers representing Yahoo accountholders could receive as much as $37.5 million in fees and expenses if the settlement is approved. Yahoo has agreed to settle a two-year-old lawsuit stemming from massive data breaches that occurred in 2013 and 2014 but weren’t disclosed until years later. A settlement fund of $50 million will be set up to cover damages. Complementary credit monitoring will also be provided to the estimated 200 million people affected by the breach according to a report from the Associated Press. Yahoo accountholders will be eligible for compensation at a rate of $25 per hour for time spent dealing with issues related to the breach. For those that can document their losses, Yahoo will cover up to 15 hours of lost time, or $375. Those unable to provide documentation may seek up to five hours of compensation, or $125. Those who paid for a premium e-mail account will also be eligible for a 25 percent refund, we’re told. Affected parties will also receive two years of free credit monitoring service from AllClear. According to the AP, Verizon – who now owns Yahoo – will pay for half of the settlement cost while Altaba, the company that manages what’s left of Yahoo’s assets, will fund the other half. Altaba has already been hit with a $35 million fine from the Securities and Exchange Commission for Yahoo’s failure to disclose the breaches to investors. A hearing to approve the settlement is scheduled for November 29 in San Jose, California.